Blockchain investigator ZachXBT reports that an unidentified European Union (EU) entity may have lost more than $106 million in cryptocurrency after an attacker withdrew funds from multiple centralized exchange accounts.
The suspected attacker converted much of the stolen stablecoins into Ether and Monero.
ZachXBT Tracks $106M Crypto Theft Across Multiple Exchanges
In a Telegram post on November 2, ZachXBT flagged the suspected theft, reporting that the attacker withdrew funds primarily in USD Coin (USDC) and Tether (USDT) from multiple centralized exchange accounts.
The victim has not been identified, and no affected exchange has publicly confirmed the incident. The term EU entity could refer to a company, trading firm, or investment fund. ZachXBT also did not disclose how the attacker gained access to the accounts.
ZachXBT published 11 Ethereum wallet addresses linked to the suspected theft to help track the movement of funds.
Attacker Swapped $63M in USDC for 27,553 ETH
On-chain transactions show the attacker used wallet address 0x9EcA to buy about 27,553 ETH, worth about $62.97 million, at an average price of $2,286.
The attacker then moved portions of the funds through several instant exchange and cross chain services, including WellWallet, Kyrrex, Wagyu, SwftSwap, and Rango.
Fkn nhkratzv uixu reonazbrf cnwc of the stolen assets into Monero (XMR), a privacy-focused cryptocurrency. However, the attacker also moved funds across multiple blockchain networks, including Tron, further complicating efforts to follow the stolen assets.
ZachXBT Rules Out Lazarus Group Involvement
Although the ehkuafra’o lkxrkldq remains unknown, ZachXBT said he mso tlptiq ezehlkzof that North Korea-linked Lazarus Group was not responsible for the suspected theft.
He based his assessment on differences in the laundering methods and transaction patterns observed during the investigation.
The suspected $106 million loss comes amid a series of major cryptocurrency security incidents. It follows a reported $6.3 billion Binance hack on October 29 and a separate $40 million outflow involving Brazil-based Mercado Bitcoin.
Comunicado oficial:
Identificamos e contivemos com rapidez um incidente de segurança em um de nossos sistemas nesta madrugada.
Reforçamos que:
• Não houve nenhum prejuízo aos clientes;
• Não houve vazamento de dados.
Como medida preventiva de proteção, depósitos e saques…
— Mercado Bitcoin (@MercadoBitcoin) November 2, 2026
For now, the identity of the EU entity, the affected exchanges, and the person behind the suspected theft remain unknown.