Crypto Investor Claims Attackers Stole $24 Million in Violent Theft

The victim offered a 10% bonus for all recovered funds and asked exchanges and investigators to help trace the transfers.

A crypto holder known online as Sillytuna said on March 5 that the attackers stole approximately $24 million in tokens after threatening him with violence during an actual theft.

The incident has reignited concerns about so-called “key attacks,” a form of crime in which perpetrators use physical threats to force victims to cede control of their crypto wallets instead of attempting to hack them.

Victim describes violent coercion

In several articles on X, Sillytuna said the theft involved armed attackers who threatened serious violence unless he transferred control of his properties. He wrote that the group had used weapons and made threats of kidnapping and sexual assault, adding that police in the United Kingdom were already involved.

“Theft of $24 million in AUSD from 0x6fe0fab2164d8e0d03ad6a628e2af78624060322. It involves violence, weapons, threats of kidnapping and rape. The police are obviously involved,” he tweeted.

Blockchain analytics platforms quickly began tracking the movement of stolen assets, with Arkham sharing data showing that attackers took approximately $23.6 million in aEthUSDC linked to an address associated with Sillytuna.

The company’s analysis established that most of the funds were quickly converted to other tokens and spread across multiple wallets. Around $20 million was exchanged for DAI and placed on two Ethereum addresses. The attackers also transferred smaller portions of the funds to other networks.

Approximately $2.48 million was transferred to the Arbitrum network, where funds were routed through multiple Wagyu accounts. These accounts were then used to purchase Monero, a privacy-focused cryptocurrency that makes tracing transactions much more difficult.

Arkham also reported that approximately $1.1 million was transferred to the Bitcoin network through a bridging service, with a portion of this amount potentially being sent to a mixing service.

You might also like:

Security firm PeckShield initially described the incident as a possible address poisoning attack, but Sillytuna rejected this explanation, insisting that the funds were recovered through direct physical intimidation rather than a wallet exploit.

The victim offered a 10% bonus for any money recovered, even if it was returned by the perpetrators themselves. Additionally, it asked exchanges and blockchain investigators to help block or trace transfers.

Community monitoring effort

Shortly after Sillytuna shared her ordeal, members of the crypto community began examining the transactions in detail, with security researcher Tay Vano reporting several addresses linked to the theft and confirming that Wagyu was being used to launder funds to the privacy coin Monero.

PerpetualCow, the developer behind Wagyu, later responded, saying the platform does not freeze user funds as a matter of principle. However, they claimed that they would have stopped the transactions from going through in the first place, but were asleep when the transfers took place.

Nonetheless, they pointed out that compliance systems eventually flagged suspicious transactions, preventing additional transfers from going through.

While some community members focused on tracking down the stolen funds, others responded in different ways. For example, a group in the Solana ecosystem launched a meme token tied to the name Sillytuna and said trading fees would be intended to help offset losses.

Sillytuna’s case is not an isolated event but is part of a documented increase in keystroke attacks. Some of the best-known incidents include the January 2025 kidnapping of Ledger co-founder David Balland from his home in France, with the attackers cutting off his finger to pressure his associates into paying a ransom.

In another case, a US resident visiting London was drugged and lost around $122,000 in crypto after being tricked into smoking a cigarette containing scopolamine.