European Entity Suspected of Losing More Than $106 Million, with Funds Converted Through Monero
Key Facts
Lookonchain reported that an unnamed entity in the European Union is suspected of losing more than $106 million from accounts at several centralized exchanges, in an incident the report said occurred the day before publication. The platform cited information from on-chain investigator ZachXBT, without independently confirming the loss. The amount and incident therefore remain suspected, not independently verified. The report did not name the entity or the exchanges involved. It also did not specify how the suspects accessed the accounts or how they took them over.
According to Lookonchain, the suspected funds were initially withdrawn in USDC and USDT. Over 24 hours, the suspects converted large amounts of USDC into ETH, then moved them to spot exchanges, including WellWallet and Kyrrex. The sequence points to assets moving from stablecoins into another crypto asset before passing through intermediary platforms. The report did not specify the value of each transfer or how much money passed through each platform. It also did not say whether all the reported funds followed the same route.
Lookonchain said part of the route involved converting funds to Monero through Wagyu, then moving them across bridges between several blockchain networks. This followed the reported conversions from USDC to ETH and the transfer of assets to spot exchanges. The route described thus combined multiple assets, intermediary services and cross-chain bridges. The report provided no further details on the amounts converted to Monero or their precise timing. It also did not clarify where the funds went after crossing to other networks.
In a post on his Telegram channel, ZachXBT published 11 addresses that Coinlaw said were linked to the suspected activity. The published addresses provide specific points linked to the report, while the entity’s name and the exchanges involved were not identified. Coinlaw said the method used to take over the accounts had not been disclosed and that the losses had not been independently confirmed at the time. The publication of the addresses alone does not establish the reported losses or how they occurred. The published details remained focused on the suspected movement of funds and the addresses linked to it.
The mention of Monero in the current report comes amid broader discussion of the currency’s use to move funds linked to crypto thefts. In a report dated February 13, 2026, Bloomberg said hackers seized more than $200 million from a crypto wallet in early January and converted part of the funds to Monero. In its report on that earlier incident, Bloomberg noted that tracing Monero is difficult. The previous incident provides context for the currency’s use in another case, but does not establish a link to the current report. The available information gave no date for further details about the suspected victim or confirmation of the losses.