ZachXBT Flags Suspected $106 Million Theft From EU Entity's Crypto Exchange Accounts
ZachXBT flags suspected $106 million theft from exchange accounts
Blockchain investigator ZachXBT reported on Monday that an unidentified entity in the European Union may have lost more than $106 million in crypto from accounts held at multiple cryptocurrency exchanges on Sunday. A cryptocurrency exchange is a platform where people and organizations buy, sell, and hold digital assets.
The term "entity" can cover a range of organizations, such as a company, a trading firm, or an investment fund. ZachXBT did not specify which kind of organization was affected, and the reported losses have not been independently confirmed.
Key details at a glance
- Suspected loss of more than $106 million from accounts at multiple crypto exchanges, reported by ZachXBT on Sunday.
- The victim is described only as an unidentified entity in the European Union.
- Funds were withdrawn in USDC and USDT, two U.S. dollar-pegged stablecoins, before being moved through other cryptocurrencies and blockchains.
- ZachXBT published 11 wallet addresses linked to the suspected theft.
- He stated he is highly confident the attacker is not North Korea's Lazarus Group.
What the Telegram alert says
In a Monday Telegram alert, ZachXBT said the suspected attacker withdrew funds in USDC and USDT. These are stablecoins, meaning digital tokens whose value is pegged to the U.S. dollar.
ZachXBT published 11 wallet addresses connected to the suspected theft. He did not identify the victim or the affected exchanges, and he did not explain how the attacker accessed the accounts.
How the funds were moved
Over the following 24 hours, the attacker exchanged USDC for ether, the main cryptocurrency of the Ethereum network, according to ZachXBT. The funds were then transferred through instant-exchange services, which swap one cryptocurrency for another without requiring an account, including WellWallet and Kyrrez.
Some of the funds were converted into the privacy-focused cryptocurrency Monero (XMR) using a service called Wagyu. Monero hides transaction details, which makes stolen funds harder to trace. Unlike USDC and USDT, which their issuers can freeze, ether and Monero cannot be frozen by a central issuer.
What is confirmed so far
- ZachXBT, a blockchain investigator, reported the suspected theft and its details in a public Telegram alert.
- The laundering path described above, including the services and 11 wallet addresses, comes from his report.
- His assessment that the attacker is likely not Lazarus Group, based on multiple laundering indicators.
What remains unclear
- The identity of the EU entity and the affected exchanges.
- How the attacker accessed the accounts.
- Whether the losses actually occurred, since they have not been independently confirmed.
- The identity of the attacker. ZachXBT only ruled out one suspect, Lazarus Group.
Why this matters
The suspected theft comes days after hackers stole about $6.4 billion from Binance, an attack the FBI attributed to North Korea's TraderTraitor group, which is associated with Lazarus. BTCPay was also attacked following the Binance exploit, and Mercado Bitcoin has apparently suffered a crypto theft worth about $40 million.
The sequence of events shows funds moving from dollar-pegged stablecoins, which can be frozen by their issuers, into assets that cannot. Neither the EU entity nor any of the exchanges involved has publicly confirmed the latest suspected theft.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.