Sillytuna Hackers on the Move: Laundering $24M in Stolen Crypto Assets

The digital trail heats up as the notorious Sillytuna group executes a complex fund-shuffling operation.

The Wash Cycle Begins

Following the high-profile theft, blockchain analysts watched a familiar pattern unfold. The stolen assets—a cool $24 million worth—didn't just sit idle. They began a rapid, automated dance across wallets and protocols, a classic attempt to obscure their origin and cash out. It's the crypto criminal's playbook: steal, scatter, and convert before the heat gets too intense.

Tracking the Untraceable?

While the blockchain is transparent, modern laundering techniques leverage cross-chain bridges, decentralized mixers, and a maze of shell wallets. Each move is a calculated step to break the forensic link. Exchanges worldwide have likely been flagged with the associated wallet addresses, but the race to freeze funds is a constant, high-stakes game of whack-a-mole. The usual promises of 'enhanced security' from affected platforms ring hollow—another cost of doing business passed on to the users holding the bag.

The Bottom Line

This isn't just a $24 million loss; it's a stark reminder of the systemic pressure points. Every major heist fuels the regulatory fire, giving skeptics more ammunition. For the rest of the market? Just another Tuesday, where the promise of decentralized finance occasionally gets a costly, centralized-style security bill. The irony isn't lost on anyone—except maybe the compliance teams now working overtime.

Source: Arkham X (formerly Twitter) 

At the same time, around $900,000 worth of DAI stablecoin was converted into USDT. After the swap, the wallet amount were deposited into the BitKan platform, which connects to several partner exchanges and trading pools. 

Researchers believe this step may allow attackers to move wallet balance across different markets without drawing too much attention. 

Nearly $10M Moved Across Ethereum Wallets

Blockchain trackers also found that the attackers moved about $10 million from the Ethereum wallet address 0xd0c. Instead of sending the amount to one place, they split the money into several smaller wallets.

This technique is very common in crypto crimes. By splitting the amount into multiple wallets, it becomes harder for investigators to track the full amount.

Experts monitoring the Sillytuna hackers moving stolen assets say this is likely the first stage of laundering. The next steps may include more swaps, bridges to other blockchains, or transfers to exchanges.

For now, blockchain researchers continue to watch the wallets closely.

How the $24M Sillytuna Attack Happened?

The case began on March 4, 2026, when DeFi trader Sillytuna reported losing more than $24 million in digital assets. The stolen assets included stablecoins and Bitcoin.

This attack was unusual because it was not a technical hack. Instead of exploiting a smart contract or a protocol bug, the attackers used real-world threats and violence to force the victim to transfer funds from their wallet.

This type of incident shows that crypto security risks are not only digital. Public wallet holders and well-known traders may also face physical threats.

After the attack, investigators quickly began tracking the stolen assets across several Ethereum and Bitcoin addresses.

Security Experts Warn the Community

The latest movements have raised concerns among security researchers. Analysts say the way attackers are moving funds shows how quickly stolen crypto can spread across networks.

One analyst noted that splitting the wallet across many Ethereum wallets often happens before larger swaps or cash-outs.

Security experts also say the case highlights an important lesson for the crypto industry.

They warn that crypto security is not just about smart contracts or technology. It is also about protecting people and their personal safety.

Some community members responding to the wallet movements said incidents like this remind investors to be careful with public wallet information.

Bounty Offered as Tracking Continues 

Following the attack, Sillytuna offered a 10% bounty for the return of the funds. The offer is open to anyone who helps recover the assets, including the attackers themselves.

Meanwhile, blockchain investigators continue to track the stolen amount across wallets and networks. Suspicious addresses are being shared with exchanges and DeFi platforms to limit the attackers’ ability to cash out.

Experts say the coming days will be important. If the attackers continue splitting funds or using mixers, it may show they are preparing for larger withdrawals.

The case once again shows how blockchain transparency helps track stolen crypto, but also how difficult it can be to stop criminals once funds begin moving.