We’d love your feedback.
Take a 30-second survey to help improve The Block.
X user “Sillytuna” claimed that roughly $24 million in Aave Ethereum USDC (aEthUSDC) was stolen from him in an armed attack.
Across several X posts shared on Wednesday, Sillytuna said that the attack included violence, weapons, kidnapping, and threats of sexual assault. Although the X user stated that law enforcement is involved, authorities have yet to confirm the details of the alleged incident.
“Bruised, held off while I could, but can’t do that much with axes over your hands and feet,” the X user wrote, adding that he is now “definitely out of crypto.”
The posts quickly circulated across the crypto community, drawing attention to the scale of the alleged theft and the disturbing circumstances surrounding it.
Sillytuna also offered a 10% bounty for recovering the funds. “Reminder: 10% bounty of any funds individuals or platforms can recover for me. Even if you were involved,” the account said.
Moved across Layer 2s, Bitcoin and Monero
Blockchain analytics platform Arkham Intelligence said that the attacker moved the funds across Layer 2 networks, Bitcoin, and Monero in what appeared to be an effort to obscure the trail.
According to Arkham’s analysis, roughly $20 million of the stolen funds were stored in two Ethereum addresses in the form of DAI, while other portions were bridged to different networks.
About $2.48 million was bridged to USDC on Arbitrum, while $2.47 million was sent to Hyperliquid across 19 separate Wagyu-linked accounts, which were then used to purchase the privacy-focused cryptocurrency Monero (XMR).
The attacker also bridged about $1.1 million to the Bitcoin network via LiFi, Arkham added, noting that the thieves may have deposited 0.5 BTC into a mixing service.
Blockchain security firm PeckShield has also flagged the wallet activity shortly after the claims surfaced, echoing that roughly $24 million in assets linked to the trader’s account had been drained and transferred to another address.
Questioning credibility
While the security firms traced the movement of the funds across multiple blockchains, some market participants have questioned the credibility of the X account posting the claims.
One X user, Yokai Capital, said the profile appeared “fishy,” noting that it had no prior crypto-related posts and appeared to gain a large number of crypto-focused followers only after the viral theft claim. Sillytuna previously said in a post last year that he had deleted several years of earlier content from the account.
Beyond the posts on X, the Sillytuna account has not publicly provided additional evidence of the alleged attack, such as official law enforcement records or forensic evidence, to bolster his claims of a violent kidnapping. In recent months, violent attempts to steal crypto from social media influencers or key opinion leaders have been on the rise.
The Sillytuna X account, which has been active since June 2008, appears connected to a longtime non-fungible token and gaming entrepreneur who has used the alias across several platforms.
The Block has reached out to Sillytuna for comment.
