EU Entity Suspected of Losing $106M in Crypto Theft

An unnamed entity in the European Union is suspected of losing more than $106 million to unauthorized withdrawals from accounts held at several centralized exchanges on November 1, according to the onchain investigator ZachXBT, as reported by CoinCentral. The funds left the accounts in USDC and USDT, two dollar-pegged stablecoins. The victim, the exchanges involved and the person or group behind the withdrawals have not been publicly identified, and neither the size of the loss nor how the accounts were accessed has been independently confirmed.

ZachXBT published the alert on his Telegram channel on Monday, and Decrypt also covered the report. The investigator flagged 11 related wallet addresses and asked others to keep watching for further transfers.

Key facts

• ZachXBT said the suspected theft occurred on November 1 and involved more than $106 million taken from several centralized exchange accounts.
• The withdrawals were made in USDC and USDT by what he called an “illicit actor.”
• Within about 24 hours, according to Decrypt, the actor swapped USDC for ETH, routed funds through instant exchange services including WellWallet and Kyrrex, converted some to Monero via Wagyu and bridged assets across multiple chains.
• ZachXBT published 11 Ethereum addresses tied to the case and said he could state with a high degree of confidence that Lazarus Group was not responsible.
• No affected EU organization or exchange has publicly confirmed the withdrawals, and no final loss breakdown has been released.

Laundering route and why it matters

The movement of funds follows a pattern investigators have seen before. Swapping out of USDC for ether was a step also reported during last week’s Binance incident, and the later push into Monero makes tracing harder because that coin conceals sender, receiver and amount.

Getting out of USDC and USDT also removes a safeguard: the companies behind those stablecoins can freeze them under certain conditions. In the Binance hack, Tether froze stolen USDT on Ethereum in 37 minutes and Circle froze all $823 million in stolen USDC, locking up about 44% of the haul, according to the analytics firm Elliptic as cited by Decrypt. It is unclear whether any funds in the EU case have been frozen.

ZachXBT did not name another suspect and did not explain each of the indicators publicly. The separate Binance attack, which researchers estimated at about $6.3 billion in the CoinCentral account and which Decrypt put at $6.4 billion, has been attributed by the FBI to TraderTraitor, a North Korean group linked to Lazarus. North Korea’s launderers have since spread the remaining Binance funds across roughly 12,000 wallets, per Decrypt. The FBI attribution and the dollar gap between the two outlets’ figures are the main places the reports diverge.

Other platforms report incidents

The suspected EU loss landed in a crowded week for crypto security. Brazilian exchange Mercado Bitcoin said it had halted deposits and withdrawals after researchers flagged more than $40 million in suspicious transfers; the company said customers were unaffected. BTCPay Server warned merchants that attackers had drained funds from software versions 2.4.1 and older, while its 2.4.7 release had no credible reports of wallet drains. Binance, meanwhile, set aside more than $6.34 billion to absorb losses, including $5 billion held in affected tokens.

Why it matters

Large holders who keep seven-figure balances on exchanges face a choice between convenience and custody risk, and this case shows the second-order problem: once stablecoins are converted to ether or Monero, the freeze lever that issuers used in the Binance hack is gone. For investigators, the unexplained denial of Lazarus involvement matters because it points away from the state-linked group that has dominated major exchange heists and toward either a different actor or an entirely separate pattern of compromise.

What to watch

The decisive next steps are whether a named exchange or EU institution confirms the withdrawals, whether any of the 11 flagged addresses see freezes or tainted-fund reports, and what ZachXBT or other analytics firms publish about the access method. Watch for a detailed loss breakdown and for any change in the Lazarus assessment as laundering traces develop.

Disclaimer: This article is for information only and is not investment, financial or trading advice. Cryptocurrency prices are highly volatile. Always do your own research.

Sources: CoinCentral, Decrypt