Crypto Investor Says Attackers Stole $24M in Brutal Hack

The victim offered a 10% bonus on any funds received and asked traders and investigators to help track the transfer.

A crypto owner known online as Sillytuna said on March 5 that attackers stole about $24 million worth of tokens after threatening him with violence during a real-world robbery.

The incident has renewed concerns about so-called “wrench attacks,” a type of crime in which criminals use physical threats to force victims to hand over control of their crypto wallets instead of trying to hack them.

Victim Describes Violent Coercion

In several articles on X, Sillytuna said the theft involved armed assailants who threatened severe violence unless he took control of his possessions. He wrote that the group uses weapons and issues threats of kidnapping and sexual assault, adding that the police in the United Kingdom are already involved.

“$24 million dollar theft of AUSD from 0x6fe0fab2164d8e0d03ad6a628e2af78624060322 Involving violence, weapons, kidnapping and threats of rape. Obvs police involved,” he tweeted.

Blockchain analytics platforms soon began tracking the movement of stolen assets, with Arkham sharing data showing attackers taking about $23.6 million in EthUSDC linked to an address associated with Sillytuna.

The company’s analysis found that most of the funds were quickly converted into other tokens and spread across all wallets. About $20 million was converted into DAI and deposited into two Ethereum addresses. The attackers also pooled small portions of funds in other networks.

About $2.48 million was transferred to the Arbitrum network, where the funds were transferred through several Wagyu accounts. Those accounts are then used to buy Monero, a privacy-focused cryptocurrency that makes tracking transactions extremely difficult.

Arkham also reported that approximately $1.1 million was transferred to the Bitcoin network through the aggregation service, half of which was likely sent to the aggregation service.

You may also like:

Security company PeckShield initially described the incident as a possible poisoning attack, but Sillytuna dismissed that explanation, insisting that the funds were taken through direct threats rather than extortion.

The victim offered a 10% bonus on any funds received, even if they were returned by the perpetrators. Additionally, he asked traders and blockchain investigators to help block or track transfers.

Community Tracking Effort

Soon after Sillytuna shared his grief, members of the crypto community began to examine the transaction in detail, with security researcher Tay Vano flagging several addresses linked to the theft and confirming that Wagyu was being used to launder the Monero privacy currency.

PerpetualCow, the developer behind Wagyu, later responded, saying the platform does not freeze user fees as a matter of policy. However, they said that they were going to stop the transaction from the beginning, but they were asleep when the money was transferred.

However, they pointed out that compliance systems end up flagging suspicious transactions, preventing further referrals from going through.

While some members of the community are focused on tracking down the stolen funds, others have responded in different ways. For example, a group within the Solana ecosystem launched a meme token linked to the name of Sillytuna and said that the trading costs will be directed to help offset losses.

Sillytuna’s case is not an isolated incident but is part of a documented increase in wrench attacks. Some of the high-profile incidents include the January 2025 kidnapping of Ledger founder David Balland from his home in France, with attackers cutting off his finger to pressure his colleagues into paying a ransom.

In one case, an American citizen visiting London got drunk and lost nearly $122,000 in crypto after being tricked into smoking a cigarette laced with scopolamine.