A suspected theft of more than $106 million from a European Union-based entity has drawn fresh scrutiny to crypto laundering techniques, according to pseudonymous blockchain investigator ZachXBT.
On November 1, an unidentified attacker drained funds from accounts held across multiple centralized cryptocurrency exchanges, ZachXBT reported. The suspected stolen assets included Circle's USDC and Tether's USDT.
Laundering through swaps and privacy coins
After the suspected theft, the attacker reportedly moved the funds through a series of transactions to obscure their trail. The illicit actor initially swapped the stolen USDC and USDT into Ethereum (ETH), then transferred the ETH to instant cryptocurrency exchanges, including WellWallet and Kyrrex.
The attacker subsequently converted ETH into Monero (XMR), a privacy-focused cryptocurrency that conceals transaction details such as sender, recipient, and amount, making tracing more difficult. The suspected hacker also reportedly bridged assets across multiple blockchain networks, adding further complexity to the investigation.
Not Lazarus Group, investigator says
Despite the scale of the incident and the laundering methods involved, ZachXBT stated with a high degree of confidence that the attacker is not North Korea's Lazarus Group, based on multiple laundering indicators. The EU entity has not yet publicly confirmed the suspected theft.
MiCA context
The incident comes after the European Banking Authority recognized USDC as the EU's first major e-money token under MiCA. The European Securities and Markets Authority has also directed national regulators to restrict services involving non-MiCA-compliant stablecoins to sell-only, conversion, transfer, and withdrawal functions, with continued services subject to strict supervision.
