Suspicious outflows totaling about $21 million from addresses tied to Japan-based crypto miner SBI Crypto were labeled “stolen” by a blockchain expert. 

Blockchain sleuth ZackXBT highlighted the movements from the company, writing on Telegram that the missing funds included Bitcoin, Ethereum, Litecoin, Dogecoin, and Bitcoin Cash. 

He added that the funds were moved to “instant exchanges” or laundered through coin mixer Tornado Cash. 

The incident is the latest in a series of breaches this year, including the $1.4 billion hack of crypto exchange Bybit and theft of almost $50 million from crypto neobank Infini. The total amount stolen from various crypto entities this year by the end of February had already nearly matched 2024’s full-year total. 

Tornado Cash is a coin mixing app that allows users to hide their Ethereum transactions. The U.S. Treasury Department put the mixing service on the Specially Designated Nationals list in 2022 but removed it from the list this year. 

The U.S. Justice Department and other law enforcement agencies globally have alleged that North Korean state-sponsored hacking group Lazarus Group had used the app to launder stolen funds. Investigators have linked Lazarus to the Bybit exploit and a number of other incidents. The group typically tries to hide stolen funds through decentralized exchanges and obfuscating apps. 

ZachXBT wrote on Telegram that “several indicators share similarities to other known Democratic People’s Republic of Korea attacks.”

He added that SBI Crypto had yet to publicly disclose the incident.

Decrypt reached out to SBI Crypto but did not immediately receive a response.

SBI Crypto is a crypto mining pool owned by Japan’s publicly-traded investment management company SBI Group. 

The company’s crypto arm, SBI VC Trade, last year agreed to take control of Bitcoin exchange DMM Bitcoin’s customer assets and accounts following a $308 million hack.