Blockchain investigator ZachXBT reported that an unidentified entity in the European Union may have lost more than $106 million from accounts at multiple cryptocurrency exchanges on Sunday. The suspected theft involved funds withdrawn in USDC and USDT, which were subsequently swapped for Ether (ETH) using instant exchange services like WellWallet and Kyrrex. The attacker then converted these assets into Monero (XMR) through the swap service Wagyu to obscure their origin. ZachXBT identified 11 wallet addresses associated with the stolen funds but noted that the movement patterns pointed away from a connection to North Korea’s Lazarus Group. Neither the affected entity nor the specific exchanges involved have been publicly named.
This incident follows the recent $6.3 billion Binance hack attributed by the FBI to North Korean hackers known as “TraderTraitor,” a group linked to Lazarus. In a separate development, pseudonymous monitoring account Onchain Lens reported that a wallet associated with King, an automated arbitrage trading bot on Solana, may have lost approximately $786,000 on Monday. The funds moved through several Solana wallets before being transferred to Ethereum via Mayan, a cross-chain bridge service. Onchain Lens stated that the rapid transfers suggested an attempt to conceal the funds’ origin and indicated a possible wallet compromise. However, King’s operator has not confirmed any security breach.
The simultaneous reporting of two distinct crypto thefts highlights the persistent vulnerability of centralized exchange accounts and automated trading infrastructure to sophisticated laundering techniques. The $106 million loss demonstrates how attackers leverage instant exchange services and privacy coins like Monero to break transaction trails across different blockchains, complicating recovery efforts. While ZachXBT explicitly distanced this event from the Lazarus Group, the scale suggests organized criminal activity rather than opportunistic hacking, raising concerns about the adequacy of current anti-money laundering controls within major exchanges.
The potential compromise of the King arbitrage bot underscores operational risks inherent in automated financial tools. If confirmed, the loss of $786,000 reveals weaknesses in key management or API security for high-frequency trading bots. The use of cross-chain bridges like Mayan to move assets from Solana to Ethereum indicates that attackers are increasingly proficient in navigating multi-chain environments to obscure fund origins. This pattern necessitates stricter monitoring of unusual withdrawal behaviors and enhanced security protocols for both institutional entities and individual algorithmic traders.
