ZachXBT flags suspected $106M theft from EU entity's exchange accounts

Author: Crypffalo Research · 05:52 03/11/2026

Onchain sleuth ZachXBT says an unnamed EU entity likely lost over $106 million in stablecoins from several centralized exchange accounts on Nov 1, with funds being laundered through ETH and Monero.

ZachXBT flags suspected $106M theft from EU entity's exchange accounts

An unnamed entity in the European Union is suspected of losing more than $106 million from several of its accounts on centralized exchanges. Onchain investigator ZachXBT flagged the incident in a Telegram post on Nov 2.

According to ZachXBT, the funds were withdrawn as USDC and USDT on Sunday, Nov 1. It is the latest large loss in a week already rattled by the roughly $6.3 billion Binance hack.

Key takeaways

Losses: More than $106 million in stablecoins (USDC, USDT), per ZachXBT.
Victim: An EU-based entity that has not been named; no official confirmation from the victim yet.
Attacker: Unidentified, though ZachXBT says "with a high degree of confidence" it is not Lazarus Group.
Fund flow: USDC swapped to ETH, routed through instant exchanges and Monero, then bridged across chains.
Unknown: Whether Tether or Circle has frozen any of the funds.

What has been observed

ZachXBT described the party behind the withdrawals as an "illicit actor." Over the following 24 hours, the actor moved quickly to cover their tracks.

The observed steps include:

Swapping USDC for ETH, likely to avoid issuer freezes.
Routing funds through instant exchange services such as WellWallet and Kyrrex.
Converting part of the haul into privacy coin Monero (XMR) via Wagyu.
Bridging assets across multiple blockchains.

Instant exchanges typically allow swaps with little identity verification. Monero hides senders, receivers and amounts, which makes tracing far harder.

How it differs from the Binance hack

ZachXBT said the laundering patterns do not match those of Lazarus, the umbrella name for North Korea's state-backed hackers. The FBI has attributed the Binance breach to TraderTraitor, a North Korean group.

In the Binance case, stablecoin issuers moved fast. According to Elliptic, Tether froze stolen USDT on Ethereum within 37 minutes and Circle froze all $823 million in stolen USDC, locking up about 44% of the haul.

For the EU case, there is no word yet on any freezes. The attacker's rush out of USDC and USDT suggests freeze risk was part of the calculation.

A crowded week for crypto security

The incident lands amid a string of breaches across the industry:

Binance: Hit by a roughly $6.3 billion hack; withdrawals have reopened and user assets are being restored.
Mercado Bitcoin (Brazil): Paused deposits and withdrawals after about $40 million to $46 million was drained across 10 blockchains, depending on the report.
BTCPay Server: Told users on older versions to shut down servers after reports of hot wallet drains.
Solana arbitrage bot: A linked wallet may have lost around $786,000, according to Cointelegraph.

What it means for crypto markets

Bitcoin traded near $76,700 on Monday evening U.S. time, down roughly 1.3% to 1.7% on the day according to Decrypt and Cointelegraph data. At $106 million, the theft is far smaller than Binance and unlikely to drive heavy selling on its own, but it extends the cautious mood.

Bull case: The victim or affected exchanges come forward quickly and some funds are frozen or recovered, framing this as an isolated incident.
Risk case: More affected venues surface, or a shared weakness in institutional account security emerges, accelerating outflows from exchanges and ETFs.

The run of incidents could also push U.S. and European regulators to tighten custody and access-control requirements for centralized exchanges.

What to watch next

The identity of the victim and which exchanges held the drained accounts.
Statements from Tether and Circle on freezing any remaining stablecoins.
Further tracing by ZachXBT and analytics firms as funds move through Monero.
Restoration progress at Binance and Mercado Bitcoin; follow real-time liquidations and the economic calendar.

Frequently Asked Questions

Who is the victim of the $106 million theft?

ZachXBT only said it is an EU-based entity and did not name it. At the time of writing, neither the victim nor any exchange has confirmed the incident.

Is this linked to the Binance hack?

There is no evidence of a link so far. ZachXBT believes the attacker is not Lazarus, while the FBI has tied the Binance hack to North Korean hackers.

Why did the attacker convert to Monero?

Monero obscures transaction details, making funds hard to trace. Moving out of USDC and USDT also helps avoid issuer freezes.

*This content is for information only and is not financial advice.*

Tags: Security, Hack, ZachXBT, Stablecoins, Monero

Crypffalo: Crypto news & data