An entity based in the European Union may have lost more than $106 million in a theft that affected multiple accounts it held on centralized exchanges, according to on-chain investigator ZachXBT.
The victim has not been named, and the method of compromise has not been disclosed. The publicly available information focuses on how the funds moved after the theft.
How the funds moved
The attacker mainly withdrew the funds as USDC and USDT, both stablecoins designed to maintain a value pegged to the U.S. dollar. The stablecoins were quickly swapped into ETH, Ethereum's native token, according to the tracing.
The funds then passed through instant exchange services, including Kyrrex and WellWallet. The research points to Wagyu as the venue where the assets were converted into Monero, ticker XMR, a privacy-focused cryptocurrency that obscures transaction details.
After the Monero conversion, the funds were sent through cross-chain bridges, which move value from one blockchain to another. Eleven addresses tied to the incident have been publicly identified, giving investigators and exchanges a list to monitor.
What remains unknown
The identity of the victim has not been disclosed beyond the entity being based in the EU. The method of compromise also remains undisclosed. The fact that losses were spread across several exchange accounts raises questions about how an attacker reached all of them, but no explanation has been made public.
Recovery challenges
The conversion to Monero and the bridge routing make recovery complex and challenging for investigators, according to the research. The stablecoin and ETH legs occurred on public ledgers, allowing researchers to reconstruct them. The Monero leg is where public tracing becomes far harder.
The instant exchange services named in the tracing may also face questions. Kyrrex and WellWallet appear as stops on the route, and how such services handle large, fast-moving inflows from flagged sources is likely to draw attention from investigators.
What to watch
- Whether the victim is identified and explains how the accounts were breached.
- Any further activity on the eleven publicly identified addresses, which could provide fresh leads.
- How the exchanges and swap services involved respond to the theft.
