Attacker Moves $40.19 Million in Stolen Assets to HitBTC Exchange

On April 1, 2026, on-chain monitoring services detected a significant movement of illicit funds involving a high-profile theft case. An attacker, who previously defrauded a Kraken user of approximately $40.2 million through a sophisticated social engineering scheme, has transferred the remaining $40.19 million to the HitBTC cryptocurrency exchange. The transaction, occurring approximately six hours ago, marks a critical phase in the laundering process of the stolen digital assets.

Details of the Asset Transfer

Data provided by on-chain analyst Yu Jin reveals that the moved capital consisted of a substantial mix of the market's two largest cryptocurrencies. The total transfer included 7,784 ETH and 26.5 BTC. These assets were consolidated and moved from the perpetrator's primary holding addresses directly to deposit addresses associated with the HitBTC platform.

Social engineering scams in the crypto sector often involve impersonating exchange support staff or technical experts to gain unauthorized access to private keys or security credentials.

The breakdown of the transferred assets highlights the scale of the incident:

• 7,784 Ethereum (ETH)
• 26.5 Bitcoin (BTC)
• Estimated total value: $40.19 million

Exchange Choice and Regulatory Implications

The selection of HitBTC as the destination for these funds has drawn scrutiny from security researchers. Analysts suggest that the move was likely motivated by the exchange's historical reputation regarding Know Your Customer (KYC) protocols.

"The move to HitBTC is likely because HitBTC allows cryptocurrency trading and withdrawals without KYC,"

By utilizing platforms with less stringent identity verification requirements, malicious actors attempt to obscure their trail and convert stolen tokens into other assets or fiat currency before law enforcement or exchange security teams can freeze the accounts. This incident underscores the ongoing challenges faced by centralized platforms like Kraken and HitBTC in preventing the flow of funds originating from criminal activities.

In conclusion, while the traceability of the Ethereum and Bitcoin blockchains allowed analysts to flag the $40.19 million movement in real-time, the final destination of the funds poses a significant hurdle for recovery efforts. The case serves as a reminder for market participants to remain vigilant against social engineering tactics, which continue to be a primary vector for high-value asset theft in the decentralized finance ecosystem.