Investigators flag suspected $106 million theft from EU exchange accounts and possible $786K Solana bot drain

Suspected $106 million theft hits EU exchange accounts as a Solana bot wallet may have lost $786K

Blockchain investigator ZachXBT reports that an unidentified entity in the European Union may have lost more than $106 million from accounts at multiple cryptocurrency exchanges on Sunday. In a separate case reported the same weekend, a wallet linked to an automated trading bot on Solana may have lost about $786,000.

Both cases are reported by investigators, not confirmed by the affected parties. Neither victim has been publicly named.

Key details at a glance

• About $106 million may have been taken from exchange accounts of an unnamed EU entity on Sunday, per ZachXBT.
• The stolen funds were reportedly withdrawn in USDC and USDT, two stablecoins whose value is pegged to a currency like the US dollar.
• The funds were swapped to Ether (ETH), passed through instant exchange services, and converted into Monero (XMR), a privacy-focused cryptocurrency that makes tracing transfers difficult.
• ZachXBT says the movement of funds points away from North Korea's Lazarus Group.
• A wallet tied to King, an automated trading bot on Solana, may have lost about $786,000, according to monitoring account Onchain Lens.

What investigator ZachXBT reported

In a Monday post, ZachXBT said funds suspected to have been stolen were withdrawn in USDC and USDT, then moved through several cryptocurrencies and blockchains. According to the investigator, the suspected attacker swapped USDC for Ether, used instant exchange services including WellWallet and Kyrrex, and converted funds into Monero through the swap service Wagyu.

ZachXBT identified 11 wallet addresses associated with the funds. The suspected attacker has not been identified. According to ZachXBT, the way the funds moved pointed away from a link to North Korea's Lazarus Group.

The affected entity and the exchanges involved have not been publicly named.

The Solana bot wallet flagged by Onchain Lens

A wallet associated with King, an automated trading bot on Solana, may have lost about $786,000 on Monday, according to pseudonymous blockchain monitoring account Onchain Lens. King is an arbitrage bot, meaning software that automatically buys cryptocurrency in one market and sells it in another to profit from price differences.

Onchain Lens told Cointelegraph that the funds moved through several Solana wallets before being transferred to Ethereum using Mayan, a service for moving assets between blockchains. The account said the rapid transfers suggested an attempt to conceal the funds' origin and a possible wallet compromise.

King's operator has not confirmed a compromise. Onchain Lens told Cointelegraph: "Our report is based on unusual fund movements, rapid transfers and the subsequent cross-chain movement of funds, which we believe indicates an attempt to obscure their origin. This pattern strongly suggests a potential wallet compromise."

Context: the largest crypto theft on record

The reported $106 million case follows the $6.3 billion Binance hack on Oct. 29, which the FBI has attributed to North Korean hackers known as "TraderTraitor," a group linked to Lazarus. The FBI attributes that attack to the group; the Binance hack was the largest cryptocurrency theft on record. ZachXBT's assessment points away from Lazarus in the $106 million case.

What is confirmed

• ZachXBT publicly reported the suspected $106 million theft, the movement of funds through stablecoins, Ether, instant exchange services, and Monero, and 11 associated wallet addresses.
• Onchain Lens reported the approximately $786,000 movement from a wallet associated with the King Solana bot, and its cross-chain transfer to Ethereum via Mayan.
• The Binance hack on Oct. 29 involved $6.3 billion, and the FBI attributes it to TraderTraitor, linked to Lazarus.

What remains unclear

• The identity of the suspected attacker in the $106 million case, and whether the theft is confirmed.
• The identity of the affected EU entity and which exchanges were involved.
• Whether the King bot wallet was actually compromised; the operator has not confirmed this, and Onchain Lens describes its finding as a suspected compromise based on fund movement patterns.

Sources

• Cointelegraph