$282M BTC and LTC Theft That Pushed XMR Higher: How It Happened

A hacker stole $282M in BTC and LTC using a hardware wallet scam, then swapped funds into XMR, ETH, XRP, and LTC via THORChain.

A crypto investor reportedly lost over $282 million worth of digital assets in a large-scale social engineering scam involving a hardware wallet. 

The incident occurred around 23:00 UTC on January 10 and was first reported by blockchain investigator ZachXBT. The attacker targeted a victim holding large amounts of Bitcoin (BTC) and Litecoin (LTC), and used sophisticated methods to gain access to their wallet.

Stolen Assets Exceed $282 Million in BTC and LTC

According to ZachXBT, the attacker gained control of the victim’s hardware wallet through a social engineering scheme. The stolen assets included approximately 2.05 million LTC and 1,459 BTC, which had a combined value of more than $282 million at the time of the incident.

According to ZachXBT, at around 23:00 UTC on January 10, a victim lost more than $282 million worth of LTC and BTC in a hardware wallet social engineering scam. The attacker then converted the stolen LTC and BTC into Monero via multiple instant exchanges, briefly driving a sharp…

— Wu Blockchain (@WuBlockchain) January 17, 2026

After gaining access, the attacker began moving the assets across various networks. 

The large size of the transaction raised concerns within the blockchain analysis community. The scam quickly became one of the largest publicly known crypto thefts involving social engineering and hardware wallets.

The theft demonstrates that even cold wallets, often seen as more secure than hot wallets, can be compromised through human error or manipulation. Investigators are now tracking the flow of stolen assets as they move across different chains.

Assets Moved Through Multiple Chains and Swapped Into Monero

Following the theft, the attacker used multiple instant exchanges to convert a portion of the stolen BTC and LTC into Monero (XMR). This activity caused a noticeable spike in XMR’s price, as the sudden buy pressure affected trading volumes across various platforms.

Monero is a privacy-focused cryptocurrency, and it is commonly used by threat actors to hide asset flows. Due to its anonymous nature, tracking funds once converted into XMR becomes much more difficult for investigators and exchanges.

In addition to using instant exchanges, the attacker utilized the THORChain protocol to bridge stolen BTC across different blockchain networks. This strategy allowed the attacker to spread the funds among multiple assets, making them harder to trace.

Related Reading: Who Is Chen Zhi? Inside the $75B Crypto Scam Empire

Attacker Used THORChain to Convert BTC Into ETH, XRP, and LTC

Blockchain data shows that the attacker used THORChain to swap 818 BTC, worth around $78 million, into other cryptocurrencies. These conversions included 19,631 ETH (around $64.5 million), 3.15 million XRP (about $6.5 million), and 77,285 LTC (about $5.8 million).

According to @zachxbt, a victim lost over $282M worth of $LTC and $BTC in a hardware-wallet social engineering scam.

The attacker swapped part of the $LTC and $BTC into $XMR, triggering a sharp spike in $XMR‘s price.

The attacker also used #THORChain to swap 818 $BTC($78M) into… pic.twitter.com/7PExjntkbT

— Lookonchain (@lookonchain) January 17, 2026

This cross-chain movement helped the attacker avoid centralized exchanges, which often have stricter monitoring systems. It also reduced the chances of asset recovery by spreading the funds quickly after the theft.

Investigators continue to monitor the known theft addresses as they remain active. Security experts are urging users to be cautious and verify any communications related to wallet access or recovery procedures.