Signal

282M BTC/LTC stolen in hardware-wallet social-engineering scam

Evidence first: scan the strongest sources, then decide whether to go deeper.

Published 2026-01-16 18:56 UTCUpdated 2026-01-17 00:58 UTC
rsstelegramx
securitysocial_engineeringhardware_walletsbtcltcxmr
Source links open
Source links and full evidence are open here. Pro adds archive history, compare-over-time, alerts, exports, and workflow. Business adds Feed API integrations and team usage.
No card needed for the free brief.
Evidence trail (top sources)
top sources (2 domains)domains are deduped. counts indicate coverage, not truth.
2 top sources shown
limited source diversity in top sources
Overview

A major hardware-wallet social-engineering incident is being pieced together through reporting and investigator attribution. Multiple outlets converge on a single victim loss exceeding $282M in BTC and LTC, followed by rapid laundering activity that included conversions into XMR and cross-chain movement.

Score total
1.81
Momentum 24h
4
Evidence documents
-
Independent publishers
-
Independent origins
-
Primary sources
-
Secondary sources
-
Source types
-
Duplicate ratio
25%
Why now
  • Multiple outlets amplified ZachXBT-attributed details within the last 24 hours
  • Reports emphasize immediate post-theft laundering activity (XMR conversions, bridging)
Why it matters
  • Shows how social engineering can lead to very large losses even with hardware wallets
  • Highlights rapid laundering paths, including XMR conversions and cross-chain movement
  • Provides attributed onchain details (timing, amounts) for incident tracking
LLM analysis
Topic mix: lowPromo risk: lowSource quality: medium
Recurring claims
  • A victim lost more than $282M in BTC and LTC in a hardware-wallet social-engineering scam.
  • The attacker converted stolen BTC/LTC into Monero via multiple instant exchanges, briefly driving a sharp spike in XMR’s price.
  • ZachXBT attributed the theft timing to around 23:00 UTC on Jan. 10 and cited amounts of ~2.05M LTC and 1,459 BTC.
How sources frame it
  • CoinDeskGlobal: neutral
  • WuBlockchain (citing ZachXBT): neutral
  • The Defiant: neutral
All details below are drawn only from the linked posts; figures and flows are attributed to ZachXBT reporting as relayed by the sources.
All evidence
Show filters & breakdown
Posts loaded: 0Publishers: 3Origin domains: 3Duplicates: -
Showing 3 / 4
Top publishers (this list)
  • Thedefiant (1)
  • T (1)
  • CoinDesk (1)
Top origin domains (this list)
  • thedefiant.io (1)
  • t.co (1)
  • coindesk.com (1)