How the money moved
According to the account Monahan and Shin discussed, the attackers pulled approximately $30 million out of accounts at the bank. They didn’t send it straight into crypto.
Instead, the funds first went into newly opened fiat accounts. From there, the hackers converted the money into crypto across several centralized exchanges.
Once the money touched public blockchains, it became visible. That is where ZachXBT, the independent on-chain investigator, entered the picture.
ZachXBT traced the flow of the stolen funds and tried to coordinate with the exchanges to get the assets frozen. On paper, this is the ideal scenario: an investigator spots dirty money sitting on regulated platforms that have the technical ability to lock it down.
In practice, it stalled. The bank had not publicly acknowledged the hack, and it hadn’t released a statement about the breach while the tracing was underway.
Without that confirmation, the exchanges lacked the verification they needed to act. A third-party investigator saying “this money is stolen” is not the same as the owner of the money saying it.
Not exactly Lazarus-grade
Monahan also offered a read on who might be behind it. In her view, the operation did not appear to be tied to the Lazarus Group, the North Korea-linked outfit associated with some of the largest thefts in crypto history.
Her characterization pointed toward a less sophisticated crew. That makes the outcome more uncomfortable, not less.
If a less polished group can get stolen bank money into crypto while investigators watch, that suggests the gaps are procedural rather than technical.
The discussion also flagged concerns about latency in real-time tracking. Tracing tools can follow funds quickly, but the human and institutional response chain moves at a very different speed.
The conversation stressed the need for faster cooperation between financial institutions and exchanges. That cooperation matters most around the fiat-to-crypto onramp, the point where traditional money becomes digital assets.
Why a missing victim breaks the system
Freezing customer funds is a serious step for any exchange. A requirement for a confirmed victim works as a guardrail.
The problem shows up when the actual victim goes quiet. In this case, the institution that lost the money was the one party whose word could unlock a response, and it hadn’t spoken publicly.
Banks have their own reasons to move cautiously after a breach: internal investigations, legal review, reputational concerns. None of those timelines line up with how fast crypto can move once it hits a public ledger.
The result is an odd inversion. Crypto, often criticized as the opaque side of finance, was the part of this story where the money was visible. The traditional bank was where the information gap sat.
What this means for exchanges, banks, and users
For centralized exchanges, the case highlights an awkward position. They can be the last checkpoint before stolen funds disappear further, but they are bound by verification standards that depend on outside parties showing up.
For banks, the lesson is about speed of disclosure, at least to the right counterparties. Confirming a breach privately to exchanges holding traced funds is a different act from issuing a press release, and the two don’t have to happen on the same schedule.
ZachXBT has repeatedly shown that tracing is the easier half of the problem. This case shows the harder half: getting the institutions with the power to act to do so before the money moves again.
cryptobriefing.com
