Mystery $106 Million Crypto Theft Targets EU Entity

Highlights

An unnamed European Union entity is suspected of losing more than $106 million from multiple centralized exchange accounts on Nov. 1, according to onchain investigator ZachXBT. The funds were withdrawn in USDC and USDT, then moved through cryptocurrency swaps, instant exchange services, Monero conversions, and cross-chain bridges. ZachXBT published 11 Ethereum addresses linked to the theft and said with “a high degree of confidence” that the attacker was not North Korea’s Lazarus Group. Whether any assets in this case have been frozen remains unclear. The incident comes amid a wider period of serious crypto-security concerns, including a separate $6.4 billion Binance hack.

Sentiment Analysis

• Overall tone: The article is predominantly cautionary and negative. It describes a suspected theft exceeding $106 million, deliberate efforts to obscure the movement of funds, and multiple security incidents affecting the crypto sector.
• Investigative dimension: The account is also factual and analytical. It reports ZachXBT’s findings, the addresses he published, the assets and services involved, and his assessment that the suspected attacker is not Lazarus Group. These details provide context without identifying the victim or establishing the culprit’s identity.
• Uncertainty: The article does not confirm whether the stolen assets have been frozen or recovered. It also distinguishes the EU incident from the separate Binance hack rather than claiming a connection between them.
• Visual sentiment: The bar below represents a strongly negative security-focused tone, while recognizing that the report itself is presented as an investigation rather than an opinion.

Article Text

An unnamed entity in the European Union is suspected of losing more than $106 million from several centralized exchange accounts on Nov. 1. The incident was described by pseudonymous onchain investigator ZachXBT, who shared details in a post to his Telegram channel. The victim has not been publicly identified. According to the investigator, an illicit actor withdrew the funds in USDC and USDT, two stablecoins, from multiple accounts.

The movement of assets after the withdrawals suggests a concerted effort to make their origins harder to follow. Over the 24 hours that followed, the suspected attacker exchanged USDC for ETH and routed funds through instant exchange services, including WellWallet and Kyrrex. Some of the assets were converted into Monero through Wagyu, while other funds were bridged across multiple blockchains. ZachXBT also published 11 Ethereum addresses he linked to the theft.

These methods can complicate the tracing of stolen cryptocurrency. Instant exchange services allow users to swap one digital asset for another quickly and may require little identity verification. Monero, by contrast, is a privacy-focused cryptocurrency designed to conceal transaction details, including senders, recipients, and amounts. That privacy can make it useful to people attempting to obscure the movement of funds, although its use alone does not establish who is responsible for a transaction.

The choice to move funds out of USDC and USDT may also be significant. The companies that issue these stablecoins can freeze tokens in certain circumstances. A conversion into other assets and movement across services and blockchains could therefore complicate efforts to immobilize the funds. It remains unclear whether any assets connected to the EU case have been frozen.

ZachXBT said the person or group behind the suspected theft has not been identified. He stated that, “with a high degree of confidence,” the attacker is not Lazarus Group, citing multiple laundering indicators. Lazarus is a name commonly used for North Korea’s state-backed hacking operations. ZachXBT did not name the victim, and the information presented does not establish the attacker’s identity.

This assessment distinguishes the incident from the separate record-setting $6.4 billion Binance hack. The FBI attributed that hack to TraderTraitor, described as a North Korean hacking group. The two cases are presented as distinct events; the article does not suggest that the same group carried out both.

Stablecoin issuers acted rapidly in the Binance case. Tether froze stolen USDT on Ethereum in 37 minutes, while Circle froze all $823 million in stolen USDC. According to blockchain analytics firm Elliptic, those actions helped lock up about 44% of the haul. The comparison illustrates how issuer intervention can affect the movement of certain assets, while not indicating that the same measures have occurred in the EU case.

The article says North Korea-linked launderers have since spread the remaining Binance funds across about 12,000 wallets. It does not provide a comparable account of any confirmed recovery or freezing of assets in the suspected EU theft. The status of those funds is therefore unresolved in the reported information.

The incident came during a particularly difficult period for crypto security. In addition to the Binance hack, Brazilian exchange Mercado Bitcoin reported halting withdrawals after a $40 million hack. On the same day, BTCPay Server told merchants to switch off their servers amid reports of hot wallet attacks. Together, these reports describe several separate security concerns across exchanges and crypto-related services, without establishing that the incidents are connected.

Key Insights Table