TLDR
- An unidentified EU entity may have lost more than $106 million in cryptocurrency from multiple exchange accounts.
- Blockchain investigator ZachXBT reported the suspected November 1 theft and identified 11 related wallet addresses.
- The suspected attacker withdrew USDC and USDT before converting some funds into Ethereum and Monero.
- Investigators traced transfers through WellWallet, Kyrrex, Wagyu, and several blockchain networks.
- ZachXBT expressed strong confidence that Lazarus Group was not responsible for the suspected theft.
An unidentified EU entity may have lost more than $106 million in cryptocurrency after suspected unauthorized withdrawals from accounts at several exchanges on November 1, blockchain investigator ZachXBT reported Monday in a public Telegram alert.
The researcher said the funds left as USDC and USDT, two dollar-linked stablecoins. The victim, affected exchanges, and suspected attacker remain unidentified. Neither the reported loss nor the access method has been independently confirmed.
EU Entity Linked to Multiple Exchange Withdrawals
ZachXBT identified 11 related wallet addresses associated with the suspected theft. His Telegram alert traced transfers from exchange accounts into wallets used to move and convert the assets. He urged others to monitor further transfers.
The investigator did not establish whether exchange systems were breached or account access was compromised. No affected EU organization or exchange has publicly confirmed the reported withdrawals. Investigators have not published a final detailed loss breakdown.
Stolen Stablecoins Moved Across Several Networks
ZachXBT said the suspected attacker exchanged USDC for ether, a step also reported during last week’s Binance hack. The transfers then continued through WellWallet and Kyrrex, according to his alert.
Some funds were reportedly converted into Monero through Wagyu and moved between blockchains. Monero hides transaction details, while issuers can freeze USDC and USDT under certain conditions.
ZachXBT Rules Out Lazarus Group
ZachXBT said several patterns in the fund movements gave him strong confidence that Lazarus Group was not responsible. He did not identify another suspect or explain each indicator publicly.
In a separate case, researchers linked the Binance attack to TraderTraitor, a North Korean group linked to Lazarus. Security researchers estimated Binance lost about $6.3 billion in the October 29 incident.
Other Crypto Platforms Report Security Incidents
Brazilian exchange Mercado Bitcoin also reported a security incident after researchers flagged more than $40 million in suspicious transfers. The company said customers were unaffected and temporarily suspended deposits and withdrawals.
Separately, BTCPay Server warned that attackers had drained funds from older software versions. Meanwhile, Binance set aside more than $6.34 billion to cover losses, including $5 billion held in affected tokens. BTCPay said version 2.4.1 and older faced an identified attack method, while its latest 2.4.7 release had no credible reports of wallet drains.
