Investigator Estimates Suspected Theft From European Entity at More Than $106 Million
Key Facts
Blockchain investigator ZachXBT estimated that more than $106 million was stolen from an unnamed entity in the European Union, according to a report published by TokenPost on November 2, 2026. He said the attack took place on November 1 and targeted multiple accounts the entity held at centralized exchanges. The estimate places the incident among the largest suspected thefts covered by the report, while the identity of the affected entity and the names of the exchanges remain undisclosed. The report did not give a confirmed final loss figure, describing the amount only as exceeding the threshold estimated by the investigator. The alert also did not specify how the accounts were compromised or who was behind the activity.
According to the report, the funds were withdrawn in USD Coin and Tether, the assets ZachXBT identified as having been taken from the accounts. USD Coin was then repeatedly converted into Ether over a 24-hour period. This sequence describes a later stage in the movement of the funds and does not place Ether among the assets initially withdrawn. The account describes a shift from USDC and USDT to repeated conversions from USDC to ETH, before the funds moved to swapping services and cross-chain bridges. The report did not specify the quantity or value of each asset at each conversion step.
The report said the funds were sent to WellWallet and Kyrrex for instant swaps, then passed through Wagyu to be converted into Monero. Bridges were also used to move assets between multiple blockchain networks. The transfers described in the report, including conversions to Ether, swapping services, Monero and bridges, took place over a 24-hour period. The report did not attribute an explanation to ZachXBT for why these services or assets were chosen, so the route alone does not establish the intent of whoever carried out the transfers. The listed stages trace the funds across different services and networks, without providing a final tally of what could be tracked at each stage.
ZachXBT published a list of 11 addresses that the report said were linked to the suspected activity, and urged the community to monitor flows connected to them. The published addresses provide points from which to track the movements identified by the investigator, while the report offers no further description of transactions involving each address. The alert did not identify the European entity or name the exchanges whose accounts were compromised. The affected entity and the services from which the withdrawals began therefore remain unknown in the published information. The available details also do not include a response to the incident from the entity or the exchanges mentioned.
The published information focuses on the estimated losses, the date of the attack, the assets and transfer route, as well as the addresses the investigator urged people to monitor. The report did not mention any announcement of funds being recovered or frozen, or any investigation finding that identified those responsible for the breach. It also did not name the targeted entity or the exchanges where it said multiple accounts had been compromised. The report gave no date for a follow-up update or any announced action by the services mentioned. As of November 2, 2026, the published account remains an estimate of a suspected theft, while the victim's identity and details of the breach remain undisclosed.