Addresses linked to SBI Crypto, a subsidiary of Japan’s financial giant SBI Group, saw suspicious outflows worth roughly $21 million on Sept. 24, 2025, according to blockchain investigator ZachXBT.

The stolen funds included bitcoin (BTC), ether (ETH), litecoin (LTC), dogecoin (DOGE) and bitcoin Cash (BCH). The loot was then funneled to five instant exchanges before being deposited into Tornado Cash, a crypto mixing service that previously been sanctioned by the U.S. Treasury.

In a Telegram post, ZachXBT noted that several indicators resemble tactics used in previous North Korean state-backed cyberattacks, raising concerns that this incident could be another in a string of DPRK-linked crypto heists.

SBI Crypto operates as a mining pool under SBI Group, a publicly traded financial conglomerate in Japan with significant exposure to both traditional and digital assets.

As of publication, SBI Group has not publicly disclosed the incident or issued an official response. SBI Group did also not respond to CoinDesk’s request for comment.

North Korea-linked hacking groups, particularly Lazarus Group, have been tied to billions in stolen digital assets in recent years. The funds are often laundered through decentralized mixers like Tornado Cash, despite global regulatory crackdowns.