$106M Vanishes From EU Entity Exchange Accounts in Suspected Theft

EU entity suspected $106 million crypto exchange theft ZachXBT

Three exchanges. One unnamed victim. More than $106 million, gone in about a day — and so far, nobody hit by it has said a word in public.

That is the shape of the alert blockchain investigator ZachXBT posted on November 2. He says an entity in the European Union lost over $106 million from accounts at several crypto exchanges on November 1, pulled out as dollar-pegged stablecoins and then pushed fast through other coins and chains.

Key points:

ZachXBT flags over $106 million pulled from an unnamed EU entity's exchange accounts on November 1, taken out as USDC and USDT.
Within a day the money was swapped into ether, run through quick-swap services, and part of it was turned into Monero, which hides the trail.
No victim and no exchange has confirmed a theft yet, and ZachXBT says it was almost certainly not North Korea's Lazarus Group.

On November 1, the suspected attacker withdrew the funds as USDC and USDT, the two dollar-pegged stablecoins, from accounts tied to the entity at more than one exchange. In the 24 hours after, ZachXBT says, the actor swapped USDC for ether at a fast pace, sent funds through instant-exchange services called WellWallet and Kyrrez, and used a swap service called Wagyu to turn part of the haul into Monero. He published 11 wallet addresses tied to the suspected theft, and a flow chart credited to TRM Labs that labels the source wallets only as Exchange 1, Exchange 2 and Exchange 3, with no names attached.

Other outlets that checked the chain found the same movement. BeInCrypto's review of Ethereum transactions found roughly $80 million in USDC arriving at the 11 wallets over 11 hours, and in five of those wallets, around $9.6 million moved out again within three minutes. Unchained, reading the same TRM Labs chart, reports about 2.64 million USDC moving to an address that feeds a cluster tagged as Wagyu, and 2,200 ether bridged onward to a Tron-format address. Those checks do not prove a theft. They do show real money moving fast through the exact wallets ZachXBT flagged.

Do not call this an exchange hack yet

Most readers will hear "$106 million from exchange accounts" and picture a breached exchange. The facts so far point somewhere else. Nobody has named a broken exchange system, and BeInCrypto notes there is currently no public evidence of a wider breach hitting ordinary customers in Europe. What the chain shows is money leaving one customer's accounts at several exchanges, not a hole in an exchange itself. I read it this way: the transfers look real, the theft label does not — yet.

That gap matters, and it is worth saying plainly. The $106 million figure is ZachXBT's estimate from his own alert, not a loss any victim or exchange has confirmed. The victim's name, the exchanges involved, and how the accounts were opened up all stay unknown. Treat that number as a strong lead, not a proven fact. If a victim or an exchange comes out and denies it, or puts a different number on it, the story changes, and this post's headline claim changes with it.

One suspect is already off the table, at least in ZachXBT's view. He wrote that he can say with a high degree of confidence the actor is not Lazarus Group, based on several signs in how the money was washed. That stands out because the suspected theft lands days after the $6.3 billion Binance hack, which the FBI tied to North Korea's TraderTraitor group, linked to Lazarus. Same week, same laundering playbook in broad strokes, different actor, if ZachXBT is right.

Why the stablecoin-to-Monero path decides what can be saved

For traders, the route the money took is the whole game. USDC and USDT can be frozen by the firms that issue them, Circle and Tether, which can blacklist an address and stop those tokens from moving. Ether has no such switch. Monero goes further: it hides senders, receivers and amounts by design, so once funds turn into Monero, the trail goes cold in a way no freeze can fix. That is why the first hours after a theft like this turn into a race, with investigators and issuers trying to freeze the stablecoin slice before it gets swapped away.

The 11 published addresses are the practical tool in that race. Compliance teams at exchanges and swap services can screen deposits against them, and any USDT or USDC still sitting in them stays within Tether's and Circle's freeze powers. The catch is speed. BeInCrypto's check shows millions moving out of flagged wallets within minutes of landing, so a freeze that comes a day late may find the stablecoins already gone, swapped into ether or Monero. Traders watching this should watch the addresses, not the headlines: fresh freezes, or fresh movement, will say more than the next round of posts.

What to watch next

Four things will settle this story, and they will come in a clear order. First, a statement from the victim or one of the exchanges, confirming a theft or denying it, with a number of its own. Second, freezes from Circle or Tether on the flagged addresses, which would show the issuers treat the funds as stolen. Third, movement in the flagged wallets: if the remaining stablecoins sit still, a freeze still has teeth, and if they drain into Monero, that window shuts. Fourth, any sign of who held the account logins, since a theft from accounts looks very different from a breach of an exchange, and the fix for each is different too.

For anyone keeping funds on an exchange, the near-term step is dull but real: turn on withdrawal address allowlists if your exchange offers them, so even a logged-in thief cannot send funds to a fresh address, and keep sums you do not trade with off exchanges entirely. That step would not have stopped every kind of account theft, but it is the one control that directly blocks the exact move seen here, funds leaving to new wallets in minutes.

— BitByLine News Desk

This post is news only, not financial advice. BitByLine never tells anyone to buy or sell crypto. Whether you buy or not is your own decision and your own risk, so always do your own research first.

Read our full Disclaimer.

Sources: CoinDesk, Unchained, BeInCrypto

BitByLine

Search This Blog