Cryptocurrencies’ sudden tumble this week flushed out legions of speculators — and also, judging from blockchain data, the perpetrator of a giant hack.

A crypto wallet linked to an almost $600 million heist of Binance Coin (BNB) last October had digital-asset collateral totaling $63 million liquidated on crypto lending platform Venus Protocol, according to Blockchain forensics firm PeckShield. The hacker had pledged the stolen crypto as collateral for a $30 million loan of the USDT stablecoin.

The identity of the hacker — or hacking group — who struck the “cross-chain bridge” known as BSC Token Hub remains a mystery. Several similar attacks that roiled the cryptosphere over the past two years have been attributed to Lazarus Group, the hacking collective linked to the North Korean regime.

Read more: A $568 Million Hack of Binance Coin Roils Crypto Sector Anew

More than $1 billion of cryptocurrency positions were unwound within a 24-hour period as a jump in global bond yields shattered weeks of calm in digital assets, sending Bitcoin and other tokens plunging, according to Coinglass.

The BNB exploiter was no exception, thanks to the so-called smart contracts that govern decentralized-finance protocols like Venus. Once BNB dropped below $220, three collateral positions linked to the wallet got automatically liquidated. BNB was trading at around $219 at 10:08 a.m. in London on Friday.

In total, the hacker had borrowed $147.5 million worth of stablecoins like USDT, USDC and BUSD by depositing 900,000 BNB from the October heist — worth about $197 million at Friday’s market price — as collateral on Venus, PeckShield told Bloomberg News over Telegram.

Read more: Bitcoin Plunge Spurs Liquidations as SpaceX’s Token Sale Weighs