At a Glance
- A hardware-wallet social-engineering scam drained $282 million in BTC and LTC on January 10, 2026
- The attacker swapped the loot through THORChain, pushing Monero from $450 to nearly $800 in days
- Community backlash hits THORChain for touting its crime-facilitating speed
- Why it matters: Even cold-storage users now face social-engineering risk, and privacy-coin demand can spike overnight
A single social-engineering ploy has become one of crypto’s largest individual heists. On January 10, 2026, around 11 pm UTC, an unidentified victim lost control of a hardware wallet containing Bitcoin and Litecoin now valued at over $282 million. The attacker immediately converted the assets, funneling them through THORChain and triggering a sharp rally in Monero.
Inside the $282 Million Drain
Popular on-chain investigator ZachXBT revealed the theft on Friday. The scam began with a classic romance angle: a fake persona-typically an attractive woman professing sudden affection-lured the target into revealing wallet credentials. Once inside, the perpetrator transferred the holdings out and began swapping.
- Stolen assets: BTC and LTC totaling $282 million+
- Conversion path: routed through multiple instant exchanges
- Final destination: primarily Monero (XMR), with portions bridged to Ethereum, Ripple, and Litecoin via THORChain
THORChain’s Role Sparks Outrage
THORChain’s own posts on X bragged about transaction speed, angering users who accuse the protocol of “celebrating” crime facilitation. Critics argue that touting rapid cross-chain swaps without highlighting security implications sends the wrong signal.
Community reactions:
- Some blame THORChain’s social-media tone
- Others stress broader dangers of social engineering
- Security advocates remind holders that hardware wallets remain vulnerable if seed phrases are shared
Monero’s Lightning Rally
Before the swaps began, Monero traded near $450. Demand from the attacker’s conversions catapulted XMR to consecutive all-time highs, peaking near $800 on January 15. Profit-taking followed; the token later slipped below $630, suggesting partial offloading of proceeds.
Price timeline:
| Date | XMR Price | Event |
|---|---|---|
| Jan 10 | ~$450 | Theft occurs, swaps start |
| Jan 12-14 | $600-$750 | Rally accelerates |
| Jan 15 | ~$800 | All-time high reached |
| Post-Jan 15 | <$630 | Retracement as coins sold off |
Social Engineering Meets Cold Storage
The incident underscores a critical gap: even offline storage fails when users surrender credentials. Hardware wallets protect against remote hacks, but they cannot stop an owner from willingly approving transactions after manipulation.
Typical scam flow:
- Attacker builds trust via fake romantic interest
- Victim asked to “help” or share screen/seed phrase
- Funds moved out before victim realizes
- Thief uses privacy coins and cross-chain bridges to obscure trail
## Market Ripple Effects
Beyond Monero, the event spotlighted privacy-coin liquidity. Exchange order books saw unusual depth as the thief sliced orders to avoid slippage. THORChain’s volume spiked, and on-chain analysts noted increased activity across bridge contracts.
Key takeaways:
- Social engineering remains crypto’s biggest attack vector
- Privacy coins can surge rapidly on concentrated buying
- Protocol marketing that highlights speed over risk draws criticism
- Users must guard seed phrases as carefully as private keys
Authorities have not announced arrests, and the attacker’s identity stays unknown. For now, the crypto community watches chain data for further movement of the remaining loot while security advocates repeat one mantra: verify, then trust-especially when love appears suddenly online.
