• On-chain researcher ZachXBT reported that $21 million worth of crypto was transferred from SBI wallets to Tornado Cash.
• The suspicious activity reflects patterns connected to North Korean hacker groups.
• SBI Crypto has yet to confirm the attack, which included the withdrawal of Bitcoin and several altcoins.

On-chain researcher ZachXBT reported a potential hack of Japanese mining pool SBI Crypto, involving the withdrawal of $21 million worth of Bitcoin (BTC), Ethereum (ETH), Litecoin (LTC), Dogecoin (DOGE) and Bitcoin Cash (BCH).

SBI Crypto suffers $21 million exploit traced to North Korea hackers

Japanese firm SBI Crypto has reportedly suffered a $21 million hack on its platform, according to blockchain investigator ZachXBT in a Wednesday update.

The on-chain sleuth stated that attackers drained wallets linked to SBI Crypto, which is a subsidiary of SBI Group, with several cryptos, including Bitcoin, Ethereum, Litecoin, Dogecoin and Bitcoin Cash, "transferred to five instant exchanges and deposited to Tornado Cash."

The incident bears hallmarks of previous North Korean-linked exploits, ZachXBT noted, making them prime suspects for the hack. He also added that blockchain security firm Cyvers assisted in the investigation of the case. SBI Crypto has yet to confirm the incident.

The breach adds to a series of crypto exchange hacks in 2025, a majority of which have been traced to North Korean groups.

A notable exploit was the Bybit hack in February, when hackers stole approximately $1.4 billion worth of ETH from the Dubai-based exchange. The event is regarded as one of the largest crypto hacks in history.

Similar hacking events have prompted regulatory authorities to intensify their scrutiny of crypto mixing services, such as Tornado Cash. In 2023, the US Department of Justice (DOJ) charged the platform's co-founder, Roman Storm, with conspiracy to commit money laundering and sanctions violations.

The US Treasury's Office of Foreign Assets Control (OFAC) initially sanctioned Tornado Cash in August 2022. Those measures were aimed at limiting its role in illicit finance, but the sanctions were lifted earlier this year.

However, the DOJ pressed on with its charges against Storm. In August 2025, a Manhattan jury found Storm guilty of conspiracy to operate an unlicensed money transmitting business.