On-chain researcher ZachXBT has raised alarms over a suspicious transfer of 3,520 Bitcoin, worth roughly $330.7 million

On-chain researcher ZachXBT has raised concerns over a substantial transfer of 3,520 Bitcoin, valued at approximately $330.7 million, which has sparked interest in a possible major theft. The incident also led to a sharp rise in the price of Monero, suggesting a potential link.

In a post shared on X, the on-chain analyst reported that the Bitcoin was transferred from what appears to be a compromised wallet to the address beginning with “bc1qcry” and ending in “vz55g.” The funds were subsequently laundered through more than six instant exchange platforms before being swapped for Monero (XMR).

The large-scale swap appeared to fuel a sharp rally in XMR, sending its price soaring by 50% in a matter of hours. However, the cryptocurrency has since shed some of these gains.

In a follow-up post on X, on-chain analyst ZachXBT elaborated on why the $330 million Bitcoin transfer is being linked to a theft.

He noted that the wallet in question had been dormant for a significant period, suggesting long-term holdings unlikely to be moved without cause.

The wallet was also linked to major regulated exchanges such as Gemini, River, and Coinbase—platforms where users are typically identity-verified, making such behavior unusual for a legitimate user.

Additionally, rather than consolidating the funds into a single transaction, the sender fragmented the Bitcoin into numerous smaller transfers and routed them through multiple instant, non-KYC exchanges. This approach, commonly associated with laundering, points to an effort to obscure the origin of the funds.

ZachXBT also emphasized that the method of dispersal would result in substantial losses from fees and inefficiencies—an impractical strategy for any legitimate user, but one that aligns with attempts to conceal illicit activity.

When asked whether North Korea—potentially referencing the state-sponsored Lazarus Group—might be behind the incident, ZachXBT rejected the notion. He stated it was “highly probable it’s not,” indicating that the theft was more likely carried out by independent hackers rather than a nation-state actor.

At the time of writing, Monero is trading at $273.04, reflecting a 12.72% decline over the past 24 hours, according to CoinMarketCap data.

The incident has renewed conversations around the use of privacy coins in illicit finance, highlighting the ongoing tension between financial privacy and regulatory oversight. As scrutiny intensifies, both exchanges and blockchain analytics firms may face increasing pressure to balance user autonomy with proactive monitoring, especially as tactics used by malicious actors become more sophisticated.