<img src="https://images.cointelegraph.com/images/840_aHR0cHM6Ly9zMy5jb2ludGVsZWdyYXBoLmNvbS91cGxvYWRzLzIwMjUtMDQvMDE5Njg2OWMtM2E0OC03MmI0LWEyYjQtYjc2MzAzYThkNWRk.jpg"><img src="https://images.cointelegraph.com/images/840_aHR0cHM6Ly9zMy5jb2ludGVsZWdyYXBoLmNvbS91cGxvYWRzLzIwMjUtMDQvMDE5Njg2OWMtM2E0OC03MmI0LWEyYjQtYjc2MzAzYThkNWRk.jpg" alt="$330M Bitcoin social engineering theft victim is elderly US citizen">An elderly US individual is reportedly the victim of a devastating $330 million Bitcoin heist, now ranked as the fifth-largest crypto hack in history.The attacker used advanced social engineering tactics to gain access to the victim&rsquo;s wallet, onchain investigator ZachXBT said in an April 30 <a data-ct-non-breakable="null" href="https://x.com/zachxbt/status/1917535854085497185" rel="null" target="null" text="null" title="null">update</a> on X.The hack took place on April 28, 2025, when ZachXBT flagged a suspicious transfer involving 3,520 Bitcoin (<a data-ct-non-breakable="null" href="/bitcoin-price" rel="null" target="null" text="null" title="null">BTC</a>), valued at $330.7 million.Following the transfer, the stolen stash was quickly laundered through over six instant exchanges and swapped into privacy-focused cryptocurrency Monero (<a data-ct-non-breakable="null" href="/xmr-price-index" rel="null" target="null" text="null" title="null">XMR</a>).Onchain data shows that the victim had held over 3,000 BTC since 2017, with no prior history of large-scale transactions.<figure><img alt="$330M Bitcoin social engineering theft victim is elderly US citizen" src="https://s3.cointelegraph.com/uploads/2025-04/01968692-b764-7830-8819-817a3f9a0b83" title=""><figcaption style="text-align: center;">ZachXBT confirming the victim of the hack. Source: ZachXBT</figcaption></figure>Once stolen, the attacker wasted no time laundering the Bitcoin using a peel chain method &mdash; a common obfuscation technique in which large sums are broken into smaller, harder-to-trace chunks.&ldquo;$330M in BTC was received in two transactions, then immediately distributed via peel chains,&rdquo; Yehor Rudytsia, onchain researcher at Hacken, explained to Cointelegraph.<blockquote>&ldquo;Funds started to flow into multiple instant exchanges / mixers with small amounts, then mixers were distributing funds across multiple new wallets. The biggest funnelling chain is now consists of 40+ wallets.&rdquo;</blockquote>Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/loopscale-recovers-funds-after-defi-exploit-hacker-negotiations" rel="null" target="null" text="null" title="null">Loopscale recovers $2.8M after weekend DeFi hack and bounty talks</a><h2>Over 300 wallets and 20 exchanges were involved</h2>Hacken&rsquo;s internal tool, Extractor, tracked $284 million worth of BTC funneled through these chains, which now amounts to around $60 million after repeated &ldquo;peeling&rdquo; and redistribution across low-credibility exchanges.Rudytsia said over 300 hacker wallets and 20+ exchanges or payment services were involved, including Binance.Cointelegraph has reached out to Binance for comment.&ldquo;Major problem in cases like this (similar to Genesis creditor&rsquo;s 4064 BTC theft back in Aug 2024) is that freezing centralized exchange accounts used in the laundering process is hardened due to particularly slow legal process of police reporting and investigations,&rdquo; Rudytsia added.Adding to the complexity, the attacker rapidly converted a significant portion of the BTC into XMR. The move triggered a <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/zachxbt-330m-btc-heist-xmr-surge-chainalysis-privacy-crypto" rel="null" target="null" text="null" title="null">50% surge in Monero&rsquo;s price</a>, with the token briefly reaching $339.&ldquo;Once funds are swapped into Monero, tracing becomes virtually impossible due to its privacy-preserving architecture. The chance of recovery drops significantly after this step,&rdquo; Cyvers Alerts senior security operations lead Hakan Unal said.Unal said that the attacker likely had pre-established accounts across multiple exchanges and OTC desks, suggesting a high degree of premeditation.A small portion of the stolen BTC was also bridged to Ethereum and deposited into various platforms, further complicating tracking efforts. Investigators have since alerted exchanges for potential freezing of funds.Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/lazarus-set-up-us-shell-companies-scam-crypto-devs" rel="null" target="null" text="null" title="null">North Korean hackers set up 3 shell companies to scam crypto devs</a><h2>No familiar laundering tactics</h2>ZachXBT had previously dismissed the theory that North Korea&rsquo;s Lazarus Group could have been behind the attack, suggesting independent hackers were responsible.<figure><img alt="$330M Bitcoin social engineering theft victim is elderly US citizen" src="https://s3.cointelegraph.com/uploads/2025-04/01968694-6812-7ad4-8828-4877efe022ca" title=""><figcaption style="text-align: center;">ZachXBT dismissing North Korea theory. Source: ZachXBT</figcaption></figure>While attribution remains uncertain, experts agree the laundering tactics show rare automation and coordination for a heist of this magnitude.&ldquo;So far, we haven&rsquo;t been able to confidently link this activity to any known hacker group, as the laundering methods used &mdash; while sophisticated &mdash; don&rsquo;t clearly match the signature patterns of previously identified actors,&rdquo; Unal noted.He recommended using <a data-ct-non-breakable="null" href="https://cointelegraph.com/learn/articles/what-is-multisignature-wallet" rel="null" target="null" text="null" title="null">multisignature (multisig) wallets</a> to eliminate single points of failure, minimizing exposure to hot wallets connected to the internet, regularly rotating private keys, and relying on hardware-based cold storage to safeguard large Bitcoin holdings.In the first quarter of 2025, hackers&nbsp;<a data-ct-non-breakable="null" href="https://cointelegraph.com/news/crypto-hack-losses-q1-2025-peckshield" rel="null" target="null" text="null" title="null">stole more than $1.6 billion worth of crypto</a>&nbsp;from exchanges and onchain smart contracts, blockchain security firm PeckShield said in an April report.&nbsp;More than 90% of those losses are attributable to a&nbsp;<a data-ct-non-breakable="null" href="https://cointelegraph.com/learn/articles/how-the-bybit-hack-happened" rel="null" target="null" text="null" title="null">$1.5 billion attack on Bybit</a>, a centralized cryptocurrency exchange, by North Korean hacking outfit Lazarus Group.Magazine:&nbsp;<a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/fifa-mythical-games-polkadot-cambria-peaky-blinders-crypto-game-web3-gamer/" rel="null" target="null" text="null" title="null">TV hit Peaky Blinders to launch crypto game, FIFA Rivals on Polkadot: Web3 Gamer</a><template data-name="subscription_form" data-type="crypto_biz" label="Subscription Form: Crypto Biz Newsletter"></template>

An elderly US individual is reportedly the victim of a devastating $330 million Bitcoin heist, now ranked as the fifth-largest crypto hack in history.
The attacker used advanced social engineering tactics to gain access to the victim’s wallet, onchain investigator ZachXBT said in an April 30 update on X.
The hack took place on April 28, 2025, when ZachXBT flagged a suspicious transfer involving 3,520 Bitcoin (BTC), valued at $330.7 million.
Following the transfer, the stolen stash was quickly laundered through over six instant exchanges and swapped into privacy-focused cryptocurrency Monero (XMR).
Onchain data shows that the victim had held over 3,000 BTC since 2017, with no prior history of large-scale transactions.
ZachXBT confirming the victim of the hack. Source: ZachXBT
Once stolen, the attacker wasted no time laundering the Bitcoin using a peel chain method — a common obfuscation technique in which large sums are broken into smaller, harder-to-trace chunks.
“$330M in BTC was received in two transactions, then immediately distributed via peel chains,” Yehor Rudytsia, onchain researcher at Hacken, explained to Cointelegraph.
“Funds started to flow into multiple instant exchanges / mixers with small amounts, then mixers were distributing funds across multiple new wallets. The biggest funnelling chain is now consists of 40+ wallets.”
Related: Loopscale recovers $2.8M after weekend DeFi hack and bounty talks
Over 300 wallets and 20 exchanges were involved
Hacken’s internal tool, Extractor, tracked $284 million worth of BTC funneled through these chains, which now amounts to around $60 million after repeated “peeling” and redistribution across low-credibility exchanges.
Rudytsia said over 300 hacker wallets and 20+ exchanges or payment services were involved, including Binance.
Cointelegraph has reached out to Binance for comment.
“Major problem in cases like this (similar to Genesis creditor’s 4064 BTC theft back in Aug 2024) is that freezing centralized exchange accounts used in the laundering process is hardened due to particularly slow legal process of police reporting and investigations,” Rudytsia added.
Adding to the complexity, the attacker rapidly converted a significant portion of the BTC into XMR. The move triggered a 50% surge in Monero’s price, with the token briefly reaching $339.
“Once funds are swapped into Monero, tracing becomes virtually impossible due to its privacy-preserving architecture. The chance of recovery drops significantly after this step,” Cyvers Alerts senior security operations lead Hakan Unal said.
Unal said that the attacker likely had pre-established accounts across multiple exchanges and OTC desks, suggesting a high degree of premeditation.
A small portion of the stolen BTC was also bridged to Ethereum and deposited into various platforms, further complicating tracking efforts. Investigators have since alerted exchanges for potential freezing of funds.
Related: North Korean hackers set up 3 shell companies to scam crypto devs
No familiar laundering tactics
ZachXBT had previously dismissed the theory that North Korea’s Lazarus Group could have been behind the attack, suggesting independent hackers were responsible.
ZachXBT dismissing North Korea theory. Source: ZachXBT
While attribution remains uncertain, experts agree the laundering tactics show rare automation and coordination for a heist of this magnitude.
“So far, we haven’t been able to confidently link this activity to any known hacker group, as the laundering methods used — while sophisticated — don’t clearly match the signature patterns of previously identified actors,” Unal noted.
He recommended using multisignature (multisig) wallets to eliminate single points of failure, minimizing exposure to hot wallets connected to the internet, regularly rotating private keys, and relying on hardware-based cold storage to safeguard large Bitcoin holdings.
In the first quarter of 2025, hackers stole more than $1.6 billion worth of crypto from exchanges and onchain smart contracts, blockchain security firm PeckShield said in an April report. 
More than 90% of those losses are attributable to a $1.5 billion attack on Bybit, a centralized cryptocurrency exchange, by North Korean hacking outfit Lazarus Group.
Magazine: TV hit Peaky Blinders to launch crypto game, FIFA Rivals on Polkadot: Web3 Gamer

An elderly U.S. citizen fell victim to a $330 million Bitcoin theft—the fifth-largest crypto hack in history—after an attacker used sophisticated social engineering to access their wallet. Onchain investigator ZachXBT reported the incident, noting the stolen 3,520 BTC was swiftly laundered.  

$330M Bitcoin social engineering theft victim is elderly US citizen

<img src="https://images.cointelegraph.com/images/840_aHR0cHM6Ly9zMy5jb2ludGVsZWdyYXBoLmNvbS91cGxvYWRzLzIwMjUtMDIvMDE5NGY5MjUtYjZlYS03ZjViLTg3NzMtOGY5NTQ2NTQ1ZTcy.jpg"><img src="https://images.cointelegraph.com/images/840_aHR0cHM6Ly9zMy5jb2ludGVsZWdyYXBoLmNvbS91cGxvYWRzLzIwMjUtMDIvMDE5NGY5MjUtYjZlYS03ZjViLTg3NzMtOGY5NTQ2NTQ1ZTcy.jpg" alt="Crypto hackers hit DeFi for $92M in April as attacks double from March">Cryptocurrency hackers stole more than $90 million in April, dealing another blow to the industry&rsquo;s mainstream reputation despite ongoing efforts to improve cybersecurity.Hackers made off with $92 million of digital assets across 15 incidents in April, according to an April 30 research report by blockchain cybersecurity firm Immunefi.The total marks a 124% month-over-month increase from March, when hackers stole $41 million.<figure><img src="https://s3.cointelegraph.com/uploads/2025-04/019686a7-e8cc-73ef-9d15-46fd9171d019" title="" alt="Crypto hackers hit DeFi for $92M in April as attacks double from March"><figcaption style="text-align: center;">Crypto stole in April 2025. Source: Immunefi</figcaption></figure>The month&rsquo;s largest hack on open-source platform UPCX accounted for most of the damage in April, with <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/unauthorized-entity-transfers-70-m-out-of-payment-platform-upcx" rel="null" target="null" text="null" title="null">over $70 million</a> in losses, while <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/kiloex-exploiter-returns-5-5-m-7-5-m-dex-exploit" rel="null" target="null" text="null" title="null">KiloEx lost $7.5 million</a> as April&rsquo;s second-largest hack.The <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/kiloex-exploiter-returns-5-5-m-7-5-m-dex-exploit" rel="null" target="null" text="null" title="null">KiloEx exploiter returned</a> the stolen funds just days after the attack occurred.All of April&rsquo;s reported attacks targeted decentralized finance (DeFi) platforms. Centralized exchanges reported no incidents during the month, the report noted. <figure><img src="https://s3.cointelegraph.com/uploads/2025-04/019686a7-ec19-701b-b6d4-31a619322ac6" title="" alt="Crypto hackers hit DeFi for $92M in April as attacks double from March"><figcaption style="text-align: center;">Top 10 losses in April. Source: Immunefi</figcaption></figure>Immunefi, which says it helps protect $190 billion in user funds, has paid more than $116 million in bounties to white hat hackers.Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/bitcoin-volatility-563-day-low-hayes-predicts-1-m-btc-2028" rel="null" target="null" text="null" title="null">Bitcoin volatility lowest in 563 days, Hayes predicts $1M BTC by 2028</a><h2>State-backed threats raise alarms</h2>The report comes nearly two months after Bybit exchange <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/bybit-exchange-hacked" rel="null" target="null" text="null" title="null">lost over $1.4 billion</a> on Feb. 21 &mdash; the <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/crypto-ftx-collapse-regulatory-evolution" rel="null" target="null" text="null" title="null">largest hack in crypto history</a>.&ldquo;The sheer scale of the attack shows how state-backed actors are arguably the most pressing threat to our industry,&rdquo; according to Mitchell Amador, Founder and CEO of Immunefi.&ldquo;This is a reminder of the need for security measures that protect the entire security stack and help protocols prevent catastrophic attacks before they happen,&rdquo; Amador told Cointelegraph, adding:<blockquote>&ldquo;Protocols must be built for resilience under the assumption that attackers will find a way in, and investors must assume that even the safest-looking interfaces or emails might be traps.&rdquo;</blockquote>He called for protocols to adopt a &ldquo;zero-trust&rdquo; approach and implement more robust protections across the entire technology stack. Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/bunq-europe-second-largest-neobank-expands-crypto" rel="null" target="null" text="null" title="null">Bunq, Europe&rsquo;s second-largest neobank, expands into crypto</a>Bug bounties, regular audits and formal verifications will be essential to ensure to security of smart contracts and backed infrastructure, he said.As of the end of April, hackers have already stolen more than $1.7 billion worth of digital assets in 2025, already surpassing the estimated $1.49 billion in losses for all of 2024, according to Immunefi.The state-backed&nbsp; <a data-ct-non-breakable="null" href="https://cointelegraph.com/people/top-people-in-crypto-and-blockchain-2023/lazarus-group/" rel="null" target="null" text="null" title="null">North Korean Lazarus Group</a>&rsquo;s pause in the second half of 2024 may have been a <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/lazarus-group-2024-pause-repositioning-1-4-b-bybit-hack" rel="null" target="null" text="null" title="null">repositioning in preparation</a> for staging the world&rsquo;s largest hack on Bybit, Eric Jardine, Chainalysis' cybercrimes research Lead, told Cointelegraph.<iframe width="100%" height="315" src="https://www.youtube.com/embed/NDv0RfehETQ?start=" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen loading="lazy"></iframe>Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/financial-nihilism-crypto-over-dream-big-again/" rel="null" target="null" text="null" title="null">Financial nihilism in crypto is over &mdash; It&rsquo;s time to dream big again</a><template data-name="subscription_form" data-type="defi_newsletter" label="Subscription Form: DeFi Newsletter"></template>

Cryptocurrency hackers stole more than $90 million in April, dealing another blow to the industry’s mainstream reputation despite ongoing efforts to improve cybersecurity.
Hackers made off with $92 million of digital assets across 15 incidents in April, according to an April 30 research report by blockchain cybersecurity firm Immunefi.
The total marks a 124% month-over-month increase from March, when hackers stole $41 million.
Crypto stole in April 2025. Source: Immunefi
The month’s largest hack on open-source platform UPCX accounted for most of the damage in April, with over $70 million in losses, while KiloEx lost $7.5 million as April’s second-largest hack.
The KiloEx exploiter returned the stolen funds just days after the attack occurred.
All of April’s reported attacks targeted decentralized finance (DeFi) platforms. Centralized exchanges reported no incidents during the month, the report noted. 
Top 10 losses in April. Source: Immunefi
Immunefi, which says it helps protect $190 billion in user funds, has paid more than $116 million in bounties to white hat hackers.
Related: Bitcoin volatility lowest in 563 days, Hayes predicts $1M BTC by 2028
State-backed threats raise alarms
The report comes nearly two months after Bybit exchange lost over $1.4 billion on Feb. 21 — the largest hack in crypto history.
“The sheer scale of the attack shows how state-backed actors are arguably the most pressing threat to our industry,” according to Mitchell Amador, Founder and CEO of Immunefi.
“This is a reminder of the need for security measures that protect the entire security stack and help protocols prevent catastrophic attacks before they happen,” Amador told Cointelegraph, adding:
“Protocols must be built for resilience under the assumption that attackers will find a way in, and investors must assume that even the safest-looking interfaces or emails might be traps.”
He called for protocols to adopt a “zero-trust” approach and implement more robust protections across the entire technology stack.  
Related: Bunq, Europe’s second-largest neobank, expands into crypto
Bug bounties, regular audits and formal verifications will be essential to ensure to security of smart contracts and backed infrastructure, he said.
As of the end of April, hackers have already stolen more than $1.7 billion worth of digital assets in 2025, already surpassing the estimated $1.49 billion in losses for all of 2024, according to Immunefi.
The state-backed  North Korean Lazarus Group’s pause in the second half of 2024 may have been a repositioning in preparation for staging the world’s largest hack on Bybit, Eric Jardine, Chainalysis' cybercrimes research Lead, told Cointelegraph.

Magazine: Financial nihilism in crypto is over — It’s time to dream big again

Cryptocurrency hackers stole $92 million from DeFi platforms in April, marking a 124% increase from March's $41 million losses, as reported by blockchain cybersecurity firm Immunefi. The surge in attacks further damages the industry's reputation despite ongoing security improvements.  

Crypto hackers hit DeFi for $92M in April as attacks double from March

KuCoin’s native token, KCS, will play a more pivotal role in the ecosystem.

KuCoin has pledged $2 billion to its "Trust Project," an initiative aimed at enhancing cryptocurrency security and transparency. The exchange's native token, KCS, will take on a more central role in supporting this effort, signaling a strategic push to bolster user confidence and ecosystem stability.  

KuCoin Commits $2 Billion to “Trust Project” Focusing on Crypto Security and Transparency

Scammers are sending physical letters to Ledger hardware wallet users, impersonating the company in an effort to steal wallet seed phrases — a phishing scheme that may be linked to Ledger&#8217;s 2020 data breach. In a recent post on X,&#8230;

Scammers are sending physical letters to Ledger hardware wallet users, impersonating the company in an effort to steal wallet seed phrases — a phishing scheme that may be linked to Ledger’s 2020 data breach. In a recent post on X,…

Scammers are targeting Ledger hardware wallet users with physical phishing letters, impersonating the company to steal seed phrases, likely exploiting data leaked in Ledger's 2020 breach.  

Ledger hardware wallet’s users targeted by mail, reportedly exploiting data leaked in 2020 breach

<img width="768" height="432" src="https://static.news.bitcoin.com/wp-content/uploads/2025/04/world_argentina_iris-768x432.jpg" class="attachment-medium_large size-medium_large wp-post-image" alt="World Launches Build Latam in Argentina, Details New Data Security Processes" decoding="async" loading="lazy" style="float:left; margin:0 15px 15px 0;" srcset="https://static.news.bitcoin.com/wp-content/uploads/2025/04/world_argentina_iris-300x169.jpg 300w, https://static.news.bitcoin.com/wp-content/uploads/2025/04/world_argentina_iris-1024x576.jpg 1024w, https://static.news.bitcoin.com/wp-content/uploads/2025/04/world_argentina_iris-768x432.jpg 768w, https://static.news.bitcoin.com/wp-content/uploads/2025/04/world_argentina_iris-190x107.jpg 190w, https://static.news.bitcoin.com/wp-content/uploads/2025/04/world_argentina_iris-380x214.jpg 380w, https://static.news.bitcoin.com/wp-content/uploads/2025/04/world_argentina_iris-760x428.jpg 760w, https://static.news.bitcoin.com/wp-content/uploads/2025/04/world_argentina_iris.jpg 1280w" sizes="(max-width: 768px) 100vw, 768px" />World, the biometric cryptocurrency and ID project, has launched Build Latam in Argentina, a program aimed at empowering tech projects to leverage World’s services in their products. Martín Mazza, Tools for Humanity regional manager for Latin America, explained the new security measures the project has implemented to protect user data. World Launches Latam-Focused Incentives, Discusses [&#8230;]

World, the biometric cryptocurrency and ID project, has launched Build Latam in Argentina, a program aimed at empowering tech projects to leverage World’s services in their products. Martín Mazza, Tools for Humanity regional manager for Latin America, explained the new security measures the project has implemented to protect user data. World Launches Latam-Focused Incentives, Discusses […]

The biometric cryptocurrency and ID project, World, has introduced Build Latam in Argentina, a new initiative to support tech projects in integrating World’s services. Martín Mazza, Latin America regional manager for Tools for Humanity, highlighted enhanced data security measures to safeguard user information. The program also includes incentives tailored for the Latam region.  

Biometric Crypto ID Project World Launches Build Latam in Argentina, Unveils New Data Security Processes

Loopscale has successfully recovered $5.8 million in funds stolen during an April 26 exploit, following negotiations with the attacker.&#160; The decentralized finance protocol announced that all user deposits have been returned, with the hacker accepting a whitehat bounty in exchange&#8230;

Loopscale has successfully recovered $5.8 million in funds stolen during an April 26 exploit, following negotiations with the attacker.  The decentralized finance protocol announced that all user deposits have been returned, with the hacker accepting a whitehat bounty in exchange…

Loopscale has recovered $5.8 million in stolen funds from an April 26 exploit after negotiating with the hacker, who returned the money in exchange for a whitehat bounty. All user deposits have been restored.  

Loopscale confirms return of $5.8m hacked funds after exploit

In December, a U.S. appeals court ruled that the U.S. Treasury’s Office of Foreign Asset Control (OFAC) exceeded its statutory authority in sanctioning Tornado Cash.

A Texas judge has ruled that the U.S. Treasury's Office of Foreign Asset Control (OFAC) overstepped its authority by sanctioning Tornado Cash, reinforcing a previous appeals court decision from December. The ruling challenges the government's ability to impose sanctions on decentralized privacy tools.  

Trending Topics

Bring the Pulse of the World to Your Phone

Stay in the Loop

U.S News

Will the unlocking of 40 million Trump meme coins significantly impact the crypto market?

Bring the Pulse of the World to Your Phone

Stay in the Loop