The victim offered a 10% bounty for any recovered funds and asked exchanges and investigators to help trace the transfers.
A crypto holder known online as Sillytuna said on March 5 that attackers stole about $24 million worth of tokens after threatening him with violence during a real-world robbery.
The incident has renewed concern about so-called “wrench attacks,” a form of crime where perpetrators use physical threats to force victims to hand over control of their crypto wallets instead of attempting to hack them.
Victim Describes Violent Coercion
In several posts on X, Sillytuna said the theft involved armed attackers who threatened severe violence unless he transferred control of his holdings. He wrote that the group used weapons and issued threats of kidnapping and sexual assault, adding that police in the United Kingdom were already involved.
“$24 million dollar theft of AUSD from 0x6fe0fab2164d8e0d03ad6a628e2af78624060322 Involved violence, weapons, kidnap and rape threats. Obvs police involved,” he tweeted.
Blockchain analytics platforms soon began tracking the movement of the stolen assets, with Arkham sharing data showing the attackers taking about $23.6 million in aEthUSDC linked to an address associated with Sillytuna.
The firm’s analysis established that most of the funds were quickly converted into other tokens and spread across several wallets. About $20 million was swapped into DAI and placed in two Ethereum addresses. The attackers also bridged smaller portions of the funds to other networks.
Roughly $2.48 million was transferred to the Arbitrum network, where the funds were routed through multiple Wagyu accounts. Those accounts were then used to purchase Monero, a privacy-focused cryptocurrency that makes transaction tracing significantly more difficult.
Arkham also reported that approximately $1.1 million was moved to the Bitcoin network through a bridging service, with part of that amount potentially sent to a mixing service.
You may also like:
Security firm PeckShield initially described the incident as a possible address-poisoning attack, but Sillytuna rejected that explanation, insisting that the funds were taken through direct physical intimidation rather than a wallet exploit.
The victim offered a 10% bounty for any funds recovered, even if returned by the perpetrators themselves. Additionally, he asked exchanges and blockchain investigators to help block or trace the transfers.
Community Tracking Effort
Soon after Sillytuna shared his ordeal, members of the crypto community began examining the transactions in detail, with security researcher Tay Vano flagging multiple addresses connected to the theft and confirming that Wagyu was being used to launder funds to the privacy coin Monero.
PerpetualCow, the developer behind Wagyu, later responded, saying that the platform does not freeze user funds as a matter of policy. However, they claimed they would have stopped the transactions from going through in the first place, but they had been asleep when the transfers happened.
Nevertheless, they pointed out that compliance systems eventually flagged the suspicious transactions, preventing additional transfers from passing through.
While some members of the community focused on tracing the stolen funds, others reacted in different ways. For example, a group within the Solana ecosystem launched a meme token linked to Sillytuna’s name and said trading fees would be directed toward helping offset the losses.
Sillytuna’s case is not an isolated event but part of a documented increase in wrench attacks. Some of the more well-known incidents include the January 2025 kidnapping of Ledger co-founder David Balland from his home in France, with attackers severing one of his fingers to pressure associates into paying a ransom.
In another case, a U.S. resident visiting London was drugged and lost approximately $122,000 in crypto after being tricked into smoking a cigarette laced with scopolamine.
Binance Free $600 (CryptoPotato Exclusive): Use this link to register a new account and receive $600 exclusive welcome offer on Binance (full details).
LIMITED OFFER for CryptoPotato readers at Bybit: Use this link to register and open a $500 FREE position on any coin!
The content published on Finance Insider Today is for informational and educational purposes only. It does not constitute financial advice, investment advice, or any other form of professional advice. Always conduct your own research and consult a qualified financial advisor before making any investment decisions. Finance Insider Today is not responsible for any financial losses resulting from decisions made based on information published on this website. Past performance is not indicative of future results. Financial markets carry significant risk. Never invest more than you can afford to lose.
