Japanese mining pool operator SBI Crypto has suffered a $21 million theft in a breach that investigators are linking to North Korea attackers.
On Oct. 1, blockchain researcher ZachXBT identified unusual outflows from the firm involving Bitcoin, Ethereum, Litecoin, Dogecoin, and Bitcoin Cash.
According to his findings, the funds moved quickly through five instant exchanges before being routed into Tornado Cash, a mixing service widely used to disguise digital asset flows.
Despite the scale of the breach, SBI Crypto has yet to release an official statement about the attack.
North Korea link
ZachXBT linked the attack to North Korea-backed attackers.
Over the past years, North Korean hackers have intensified their focus on crypto-related exploits as sanctions restrict the regime’s access to traditional financial systems.
That strategy has already made a global impact. This year alone, DPRK-backed attackers have siphoned over $1.8 billion from crypto markets, including hacks on major crypto platforms like Bybit, DMM Bitcoin, and WazirX.
This figure is more than the $1.3 billion attributed to the attackers the previous year, highlighting their growing reliance on blockchain-based thefts as revenue streams.
SBI Crypto’s market position
SBI Crypto operates as part of SBI Group, Japan’s largest digital asset conglomerate.
Data from MiningPoolStats ranks it as the 12th largest Bitcoin mining pool with around 20 EH/s in hash power, and records show it produced a block less than a day before the breach came to light.
The company also maintains a strong presence on the Bitcoin Cash network, controlling over 21% of its computing share with 900.67 PH/s. Blocks were last mined on that chain just hours before the incident.
It also maintains smaller operations in Litecoin with 3.92 TH/s, most recently finding a block two days ago.
