Onchain sleuth ZachXBT has flagged a suspicious transfer involving 3,520 Bitcoin (BTC) (valued at $330.7 million) that may indicate a major theft.

The transaction, reported on April 28, saw funds moved from a potential victim's wallet to the address bc1qcry...vz55g.

Onchain sleuth ZachXBT has flagged a suspicious transfer involving 3,520 Bitcoin (BTC) (valued at $330.7 million) that may indicate a major theft. The transaction, reported on April 28, saw funds moved from a potential victim’s wallet to the address bc1qcry...vz55g.

Following the transfer, the stolen stash was quickly laundered through over six instant exchanges and swapped into privacy-focused cryptocurrency Monero (XMR).

The large-scale conversion led to a sharp 50% spike in XMR’s price, with the token reaching an intraday high of $339, according to data from CoinMarketCap.

At the time of writing, XMR has settled slightly but remains up 25% in the past 24 hours, trading at $289.

When asked whether North Korea’s Lazarus Group was behind the attack, ZachXBT dismissed the theory, stating it was “highly probable it’s not,” suggesting independent hackers were responsible.

Related: Kraken to end Monero support in European Economic Area

Vast majority of hackers use mainstream cryptos

In a recent comment to Cointelegraph, Chainalysis noted that most criminal transactions still rely on mainstream cryptocurrencies.

“While there are concerns of more criminals moving to privacy coins for anonymity, the vast majority of criminal activity still uses mainstream cryptocurrencies, such as Bitcoin, Ethereum and stablecoins,” Chainalysis said.

The firm added that these assets remain attractive because they offer the same benefits to bad actors as they do to legitimate users — cross-border functionality, instant settlement, and high liquidity.

Chainalysis noted that privacy coins pose limitations for criminals due to reduced liquidity and the fact that many major exchanges have delisted assets like Monero.

“Cryptocurrency is only useful if you can buy and sell goods and services or cash out into fiat, and that is much more difficult with privacy coins, especially as mainstream exchanges have offboarded the use of privacy coins, such as Monero,” they explained.

The firm even said that blockchain transparency allows law enforcement to trace and recover illicit funds, regardless of the cryptocurrency used.

In 2024, a leaked Chainalysis video suggested that Monero transactions could be traceable despite the privacy-preserving nature of the blockchain.

The video reportedly showed how Chainalysis could track transactions back to 2021 via its own “malicious” Monero nodes.

Related: The IRS offers a $625,000 bounty to anyone who can break Monero and Lightning Network

Monero accepted at Spar stores in Switzerland

The suspected laundering operation comes as Monero is gaining wider retail acceptance. Two Spar supermarket locations in Switzerland recently began accepting XMR for payments.

The announcement, shared by Monero’s official X account, credits partnerships with DFX Swiss and OpenCryptoPay for enabling the integration.

One user, posting on April 25, shared their experience of purchasing organic cacao using XMR at a Spar store in Kreuzlingen.

In April 2025, Spar first tapped into the crypto market by introducing Bitcoin payments through the Lightning Network at outlets in Zug, Switzerland.