An unnamed European Union entity is suspected of losing more than $106 million from multiple centralized exchange accounts on Sunday, Nov. 1, according to pseudonymous onchain investigator ZachXBT.
In a Monday post to his Telegram channel, ZachXBT said the funds were withdrawn as USDC and USDT by what he described as an illicit actor. He did not identify the victim.
Rapid laundering moves
Within 24 hours, the actor swapped USDC for ETH, sent funds through instant exchange services including WellWallet and Kyrrex, converted some holdings to the privacy coin Monero through Wagyu and bridged assets across multiple blockchains, ZachXBT said. He published 11 Ethereum addresses tied to the theft.
Instant exchanges allow users to swap cryptocurrencies quickly, often with little identity verification. Monero obscures senders, receivers and transaction amounts. Moving out of USDC and USDT also matters because the companies behind those stablecoins can freeze them.
Not attributed to Lazarus
ZachXBT said the culprit remains unidentified but that he could say with “a high degree of confidence” that it is not Lazarus Group, citing multiple laundering indicators. Lazarus is the umbrella name often used for North Korea’s state-backed hackers.
That sets the suspected theft apart from the record-setting $6.4 billion Binance hack, which the FBI has attributed to TraderTraitor, a North Korean hacking group.
In the Binance case, Tether froze stolen USDT on Ethereum in 37 minutes, and Circle froze all $823 million in stolen USDC, helping lock up about 44% of the haul, according to blockchain analytics firm Elliptic. North Korea’s launderers have since spread the remaining funds across about 12,000 wallets. It is unclear whether any funds in the EU case have been frozen.
Broader security concerns
The suspected theft follows the record-breaking Binance hack. Brazilian exchange Mercado Bitcoin reported halting withdrawals after a $40 million hack, and BTCPay Server told merchants to switch off their servers amid reports of hot wallet attacks.
