Mystery attacker drains $106 million from EU entity's exchange accounts, investigator says

$106 million stolen from EU entity in another nine-figure crypto theft

An unnamed entity in the European Union is suspected of losing more than $106 million from several of its accounts on centralized exchanges — online platforms where users buy and sell crypto — on Sunday, Nov. 1, according to pseudonymous onchain investigator ZachXBT. He shared the findings in a post to his Telegram channel on Monday.

The funds were withdrawn as the stablecoins USDC and USDT — tokens designed to hold a fixed value in US dollars — by what ZachXBT called an "illicit actor." The victim has not been named.

Key points

• More than $106 million was reportedly taken from multiple centralized exchange accounts belonging to an unnamed EU entity on Nov. 1.
• The funds were withdrawn as USDC and USDT, then swapped for ETH and moved through laundering services.
• ZachXBT published 11 Ethereum addresses tied to the theft.
• He said "with a high degree of confidence" the attacker is not North Korea's Lazarus Group.
• It is unclear whether any of the stolen funds have been frozen.

What ZachXBT's investigation shows

In the 24 hours after the theft, the attacker moved aggressively to cover their tracks, ZachXBT said. The steps he described included:

• Swapping USDC for ETH, Ethereum's native token.
• Sending funds through instant exchange services such as WellWallet and Kyrrex. These services let users quickly swap one cryptocurrency for another, often with little identity verification.
• Converting some funds to Monero via a service called Wagyu. Monero is a privacy coin that hides senders, receivers and amounts, making it a popular tool for obscuring stolen funds.
• Bridging assets across multiple blockchains, meaning moving them between different crypto networks.

ZachXBT published 11 Ethereum addresses he tied to the theft.

How this differs from the record Binance hack

The theft lands just days after the biggest heist in crypto's history: the roughly $6.4 billion breach of Binance, the world's largest cryptocurrency exchange, which the FBI has attributed to TraderTraitor, a North Korean hacking group.

ZachXBT said the culprit in the EU case remains unidentified, but that he could say "with a high degree of confidence" it is not Lazarus Group — the umbrella name often used for North Korea's state-backed hackers. He cited multiple laundering indicators for that assessment.

In the Binance case, stablecoin issuers acted within minutes: Tether froze stolen USDT on Ethereum in 37 minutes, and Circle froze all $823 million in stolen USDC, helping lock up about 44% of the haul, according to blockchain analytics firm Elliptic. North Korea's launderers have since spread the remaining funds across about 12,000 wallets, Elliptic reported. By contrast, it is unclear whether any funds in the EU case have been frozen.

What is confirmed

• ZachXBT publicly reported the theft and his analysis of the attacker's wallet movements via Telegram.
• He published 11 Ethereum addresses linked to the stolen funds.
• The laundering path he described involved ETH, instant exchanges (WellWallet, Kyrrex), Monero (via Wagyu) and cross-chain bridges.

What is still unclear

• The identity of the victim and of the attacker.
• Whether any of the stolen funds have been frozen.
• These findings come from a pseudonymous investigator and have not been independently confirmed by authorities or the affected party.

Why this matters for crypto holders

The case shows both a risk and a safeguard. Swapping out of USDC and USDT matters because the companies behind those stablecoins can freeze them — which is exactly what happened in the Binance hack, locking up roughly 44% of that haul within days. An attacker converting to Monero and using instant exchanges makes recovery harder. The incident also adds to an already unprecedented week for crypto security: beyond the Binance hack, Brazilian exchange Mercado Bitcoin reported halting withdrawals after a $40 million hack, and BTCPay Server told merchants to switch off their servers amid reports of hot wallet attacks.

Sources

• Decrypt