The trail of $108.8 million allegedly stolen from a European entity is now mapped out — and the pattern is more disturbing than the amount.
Facts: An on-chain investigation by Bitquery (Nov. 2) traced $108.8 million in USDC out of accounts at three exchanges on Nov. 1–2: Kraken accounted for 95%, with the rest coming from OKX and Crypto.com, sent to 15 recipient wallets. Eleven of those wallets had previously received payouts from the same exchanges — one wallet even received 43 Kraken withdrawals in 91 minutes, each under $50,000. About $62.98 million was then swapped for 27,553 ETH (at an average of ~$2,286) over four hours, with some routed through Wagyu to Monero. Only $3.7 million in USDC can still be frozen. ZachXBT was the first to sound the alarm, and he’s highly confident the perpetrator isn’t Lazarus. Important caveat: neither the victim nor the three exchanges have confirmed anything, and Bitquery itself says the wallet ownership is still an inference — there’s no evidence the exchanges were breached; the withdrawals came from one customer’s account.
My take: what gives me chills isn’t the amount, but the old wallets. Allowlists don’t help if the wallets are already known to the exchanges — what was allegedly compromised was both the wallet keys and the login credentials, whether through the victim’s device or an insider. And once USDC turns into ETH, the trail practically disappears: $30.5 million has already left Ethereum.
What I’m watching: whether Circle freezes the remaining $3.7 million in USDC, whether Kraken, OKX, or Crypto.com eventually confirms anything, and whether KuCoin and Kyrrex identify the accounts that received the $8.12 million.
What do you think was the biggest vulnerability here: the exchanges, the victim’s wallet, or an insider?
This is my analysis, not financial advice — always DYOR.
#KeamananCrypto #OnChain $ETH $USDC
Facts: An on-chain investigation by Bitquery (Nov. 2) traced $108.8 million in USDC out of accounts at three exchanges on Nov. 1–2: Kraken accounted for 95%, with the rest coming from OKX and Crypto.com, sent to 15 recipient wallets. Eleven of those wallets had previously received payouts from the same exchanges — one wallet even received 43 Kraken withdrawals in 91 minutes, each under $50,000. About $62.98 million was then swapped for 27,553 ETH (at an average of ~$2,286) over four hours, with some routed through Wagyu to Monero. Only $3.7 million in USDC can still be frozen. ZachXBT was the first to sound the alarm, and he’s highly confident the perpetrator isn’t Lazarus. Important caveat: neither the victim nor the three exchanges have confirmed anything, and Bitquery itself says the wallet ownership is still an inference — there’s no evidence the exchanges were breached; the withdrawals came from one customer’s account.
My take: what gives me chills isn’t the amount, but the old wallets. Allowlists don’t help if the wallets are already known to the exchanges — what was allegedly compromised was both the wallet keys and the login credentials, whether through the victim’s device or an insider. And once USDC turns into ETH, the trail practically disappears: $30.5 million has already left Ethereum.
What I’m watching: whether Circle freezes the remaining $3.7 million in USDC, whether Kraken, OKX, or Crypto.com eventually confirms anything, and whether KuCoin and Kyrrex identify the accounts that received the $8.12 million.
What do you think was the biggest vulnerability here: the exchanges, the victim’s wallet, or an insider?
This is my analysis, not financial advice — always DYOR.
#KeamananCrypto #OnChain $ETH $USDC