An unnamed entity in the European Union is suspected of losing more than $106 million from multiple centralized exchange accounts on November 1, according to pseudonymous onchain investigator ZachXBT. The funds were withdrawn as USDC and USDT stablecoins by an illicit actor who subsequently moved aggressively to obscure the trail. Within 24 hours, the attacker swapped stablecoins for ETH, utilized instant exchange services such as WellWallet and Kyrrex, converted portions of the assets into the privacy coin Monero via Wagyu, and bridged funds across multiple blockchains. ZachXBT identified 11 Ethereum addresses linked to the theft but did not name the victim.
The investigator stated with a high degree of confidence that the perpetrator is not North Korea’s Lazarus Group, distinguishing this incident from the recent $6.4 billion Binance hack attributed to TraderTraitor. In the Binance case, stablecoin issuers Tether and Circle froze significant portions of the stolen assets within minutes, locking up approximately 44% of the haul. It remains unclear whether any funds from the EU theft have been frozen. This nine-figure loss occurs during a period of heightened crypto security concerns, following the record-breaking Binance breach and coinciding with reports of a $40 million hack at Brazilian exchange Mercado Bitcoin and hot wallet attacks affecting BTCPay Server merchants.
This theft highlights the persistent vulnerability of centralized exchange accounts and the rapid effectiveness of cross-chain laundering techniques when issuer intervention is delayed or absent. Unlike the Binance incident, where immediate freezing actions by Tether and Circle mitigated losses, the EU entity’s exposure suggests either a lack of real-time monitoring capabilities or insufficient cooperation from custodians to halt withdrawals before conversion into privacy coins like Monero. The use of instant exchanges and bridging protocols underscores how attackers exploit fragmented regulatory environments and technical gaps to obscure fund movements quickly.
The distinction from state-sponsored actors like Lazarus Group implies a different threat landscape, potentially involving sophisticated criminal syndicates rather than geopolitical operatives. However, the operational similarities—rapid conversion to privacy assets and multi-chain dispersion—indicate that defensive strategies must evolve beyond simple attribution. The industry’s focus now shifts to whether blockchain analytics firms and law enforcement can trace these specific 11 Ethereum addresses and associated bridges effectively enough to recover assets, testing the limits of current forensic tools against advanced obfuscation methods.
