Suspected crypto theft from European entity climbs to $133 million as exchanges freeze funds
On-chain investigator ZachXBT reported that a suspected crypto theft from an unidentified European entity has risen past $133 million across multiple centralized exchanges. Cryptocurrency exchanges Kraken and Crypto.com have taken steps to restrict accounts or block related assets while investigations continue.
A suspected multi-exchange theft targeting an unnamed European entity has surpassed $133 million, according to on-chain investigator ZachXBT. In an initial community alert on Nov. 2, 2026, ZachXBT warned that more than $106 million had been withdrawn on Nov. 1 in USDC and USDT from accounts across several centralized exchanges. He subsequently identified another $27 million or more in exchange withdrawals tied to the same culprit, noting that some of these transfers occurred after his first public disclosure.[8][2][7][11]
The illicit actor rapidly moved funds by swapping USDC into ether, funneling assets through instant exchange platforms including WellWallet and Kyrrex, bridging across multiple blockchains, and converting a portion into privacy coin Monero using the swap service Wagyu. Based on multiple laundering indicators, ZachXBT stated with high confidence that North Korea's Lazarus Group was not behind the exploit.[8][4][9]
ZachXBT said his working theory is that a major financial institution in Western Europe was compromised and that the breach is currently being covered up. He asserted that the absence of prompt public disclosure allowed more than $30 million to be laundered that European law enforcement agencies could otherwise have frozen. Neither the affected entity, the victim exchanges, nor regulatory bodies have publicly confirmed or denied a loss.[2][5][7][11]
Major cryptocurrency trading platforms have responded as the laundered funds circulated. Kraken restricted accounts while probing whether assets from the incident passed through its platform, confirming that its own systems and customer balances remained uncompromised. Crypto.com also blocked funds connected to the suspected theft, while OKX launched an investigation into the activity.[3][1][6][10]
Key facts
- ZachXBT reported that an unidentified European entity lost more than $106 million from centralized exchange accounts on Nov. 1, 2026, later raising the estimated total past $133 million after finding an additional $27 million in withdrawals.
- The suspected attacker withdrew the stolen funds as USDC and USDT before swapping into ether, bridging across chains, using instant exchanges WellWallet and Kyrrex, and converting funds into Monero via Wagyu.
- ZachXBT stated with high confidence that North Korea's Lazarus Group is not responsible for the theft, citing laundering indicators.
- ZachXBT suggested his working theory is that a large Western European financial institution was exploited and is concealing the breach, arguing that the delay prevented authorities from freezing more than $30 million.
- No institution, exchange, or regulator has publicly confirmed or denied suffering a loss.
- Kraken restricted certain accounts while investigating whether stolen assets passed through its service, stating its own platform and customer accounts were not breached.
- Crypto.com has blocked funds tied to the suspected incident, and OKX is investigating the activity.
Sources · 9 sources
- CB
Crypto Briefing@Crypto_BriefingPost on X ·
🚨NEW: Kraken reportedly restricted accounts tied to a suspected crypto theft exceeding $133M after ZachXBT identified another $27M in exchange withdrawals. OKX is investigating the incident while https://t.co/I4IC0rIEtk has blocked related funds. https://t.co/7fMkxh9jdq
Open source - UN
UnchainedArticle ·
ZachXBT Suspects Cover-Up as Tally on Suspected EU Theft Climbs to $133 Million Onchain investigator ZachXBT now puts a suspected theft from an EU entity at more than $133 million , up from the more than $106 million in his first alert, after he traced another $27 million-plus in centralized exchange withdrawals by the same actor. In the follow-up post on his Telegram channel, ZachXBT wrote that “a portion of the CEX withdrawals occurred after my initial disclosure.” He also listed four Ethereum addresses he tied to the theft. He offered a first guess at the victim. His working theory, he wrote, is that “a large financial institution in Western Europe was exploited and it’s currently being covered up.” He did not name the institution or set out evidence for the cover-up claim in the post. As of publication, no institution, exchange or regulator had publicly confirmed or denied a loss. Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter . How the Loot Has Moved In his original alert, ZachXBT said the funds left multiple exchange accounts on Nov. 1 as USDC and USDT, and that he was highly confident North Korea’s Lazarus Group was not behind it. Monero is where at least part of it ended up. He said the actor swapped USDC for ETH, passed funds through instant exchanges such as Kyrrex and WellWallet , then sent a portion into XMR using Wagyu . The alerts follow the Oct. 29 drain of Binance’s hot wallets , which the FBI has since attributed to North Korea’s TraderTraitor. Laundered Before a Freeze ZachXBT in his most recent alert said that silence from the victim has cost money that could have been recovered. “No proper incident disclosure has resulted in $30M+ being laundered away which could have been frozen by EU law enforcement,” he wrote. He did not say which agencies, if any, have been contacted. Why the Timing Matters Issuers such as Tether and Circle can freeze USDT and USDC held at flagged addresses, and exchanges can hold deposits tied to a theft, but those tools depend on someone raising the alarm while the funds are still within reach. Each hop into ETH and then into Monero, which hides senders, receivers and amounts by default, shrinks what investigators and police can still stop. Related Listen: Is THORChain a Money Laundering Service? A Chinese Crime Boss Says Yes The post ZachXBT Suspects Cover-Up as Tally on Suspected EU Theft Climbs to $133 Million appeared first on Unchained .
Open source - CO
Cointelegraph@CointelegraphPost on X ·
🇪🇺 JUST IN: Kraken says it has restricted accounts while investigating reports that assets from a suspected $133M EU crypto theft passed through its platform. It told Cointelegraph that its systems and customer accounts were not compromised. https://t.co/yDm45BonWN
Open source - BL
BlockNews@blocknewsdotcomPost on X ·
🚨 JUST IN: Over $106 MILLION reportedly stolen from an EU entity's accounts across multiple crypto exchanges, according to ZachXBT! The suspected attacker allegedly moved $USDC and $USDT into $ETH, then used instant exchanges, Monero, and cross-chain bridges to move the funds.
Open source - LS
Laura Shin@laurashinPost on X ·
ZachXBT says his working theory is that a large Western European financial institution was exploited and the incident is being covered up. No institution has confirmed or denied a loss. https://t.co/qoH7DSOM3P
Open source - CB
Crypto BriefingArticle ·
Kraken, Crypto.com block funds linked to suspected $133M crypto theft: Report The incident highlights the ongoing vulnerabilities in crypto exchanges and the challenges in tracking and recovering stolen digital assets. The post Kraken, Crypto.com block funds linked to suspected $133M crypto theft: Report appeared first on Crypto Briefing .
Open source - TB
The Block@TheBlockCoPost on X ·
THE BLOCK: ZachXBT says he suspects that a large Western European financial institution was exploited for more than $133 million from CEX accounts, and that the incident is currently being covered up. He notes the lack of proper disclosure has allowed the laundering of over $30 million in stolen funds that EU authorities could have frozen.
Open source - UN
UnchainedArticle ·
$106 Million Suspected Stolen From EU Entity as Funds Flow Into Monero: ZachXBT More than $106 million may have been stolen on Nov. 1 from an EU entity’s accounts at multiple centralized exchanges, according to onchain investigator ZachXBT , who said he is highly confident the culprit is not North Korea’s Lazarus Group . In a community alert posted to his Telegram channel on Nov. 2, ZachXBT said the suspected thief pulled the funds out as USDC and USDT . He wrote that he could “say with a high degree of confidence it is NOT Lazarus Group based on multiple laundering indicators,” without spelling out which indicators. The post did not identify the entity, the exchanges or how the accounts were accessed, and said the actor “remains unidentified.” As of publication, no exchange or victim had publicly confirmed a loss. Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter . Where the Funds Went According to ZachXBT, in the 24 hours before the alert, the actor was “aggressively swapping USDC for ETH,” then sent money to instant exchanges including WellWallet and Kyrrex , converted part of it to Monero (XMR) through the swap service Wagyu , and bridged funds across several chains. He listed 11 Ethereum addresses he tied to the theft. A flow graph attached to the alert, credited to ZachXBT, Specter and TRM Labs , labels the source wallets only as Exchange 1, 2 and 3. It shows about 2.64 million USDC moving on Nov. 2 to an address that feeds a cluster tagged as Wagyu, and 2,200 ETH going to an address that then bridged funds to a Tron-format address. A separate cluster carries a Kyrrex tag, and several other instant exchanges in the graph are not named. What Stays Traceable Funds converted to Monero are far harder to follow than USDC or ETH, because Monero hides senders, receivers and amounts by default. That leaves the balances still sitting at public Ethereum addresses, and the hops through named services such as Kyrrex and Wagyu, as the parts of this trail that remain visible onchain. Previously The alert lands days after Binance’s hot wallets were drained on Oct. 29 , a theft TRM Labs attributed with high confidence to TraderTraitor, a North Korean hacking unit. Related Listen: Is THORChain a Money Laundering Service? A Chinese Crime Boss Says Yes The post $106 Million Suspected Stolen From EU Entity as Funds Flow Into Monero: ZachXBT appeared first on Unchained .
Open source - CB
Crypto Briefing@Crypto_BriefingPost on X ·
🚨JUST IN: ZachXBT reports a suspected $106 million crypto theft from multiple centralized exchange accounts linked to an EU entity. https://t.co/WMy744Dntj
Open source - CT
Coin TelegraphArticle ·
Kraken restricts accounts amid suspected $133M EU crypto theft Crypto.com also took steps to block funds tied to the suspected theft, while Kraken said its systems and customer accounts were not compromised.
Open source - WB
Wu Blockchain@WuBlockchainPost on X ·
ZachXBT Suspects European Institution Is Covering Up Crypto Breach, Says $30M Could Have Been Frozen Blockchain investigator ZachXBT said he identified more than $27 million in additional suspicious withdrawals from centralized exchanges, bringing the total linked to a suspected crypto theft to over $133 million. Some withdrawals occurred after his initial disclosure. ZachXBT speculated that a major financial institution in Western Europe may have been compromised and was concealing the breach. He criticized the lack of timely disclosure, claiming it allowed more than $30 million to be laundered that EU authorities might otherwise have frozen. The victim's identity and actual losses remain unconfirmed.
Open source