Estimated Theft From European Entity Exceeds $133 Million After Additional Withdrawals Tracked
Key Facts
Blockchain investigator ZachXBT on November 3 raised his estimate of the suspected theft from an EU entity to more than $133 million, up from more than $106 million in his initial alert on November 2, according to Unchained. The revision came after he traced more than $27 million in additional withdrawals through centralized exchanges and linked them to the same entity. The update shows the amount the investigator attributes to the incident widened in one day, while it remains a suspected theft rather than a confirmed loss. ZachXBT said some of the withdrawals took place after his initial public disclosure. Reports did not name the entity or the affected exchanges.
According to the initial alert cited by Unchained, funds left accounts at multiple exchanges on November 1, and the assets cited were the stablecoins USDC and USDT. Reports described withdrawals from accounts at centralized exchanges but did not specify how those accounts were accessed. ZachXBT also did not identify the affected entity or the exchanges from which the funds were withdrawn in his initial report. CoinDesk reported that the reported losses had not been independently confirmed. The victim’s identity, the means of accessing the accounts and the actual size of the loss therefore remained unresolved in published reports.
ZachXBT described his working hypothesis as involving the exploitation of a large financial institution in Western Europe, Unchained reported, but he did not name the institution. As of the outlet’s report on November 3, no institution, exchange or regulator had publicly confirmed or denied a loss. Commenting on the incident’s disclosure, the investigator said the lack of proper disclosure led to more than $30 million being laundered and that European law enforcement could have frozen the funds. The comment reflects ZachXBT’s assessment of what happened; it does not establish that delayed disclosure enabled the laundering. Nor does the claim resolve whether the presumed entity was actually breached.
The fund flows, according to details reported by CoinDesk, included swapping USDC for ETH and then routing the funds through instant exchange services including WellWallet and Kyrrex. Some of the funds were converted into Monero using the Wagyu service. Monero is known as a privacy-focused cryptocurrency, making the movement of some funds into it a notable part of the tracing path described by the investigator. CoinDesk did not describe these transfers as having passed through cross-chain bridges. ZachXBT also said he was highly confident that the Lazarus Group was not responsible, citing multiple indicators in the laundering pattern.
In its coverage, CoinDesk noted that suspicions of a loss by the European entity emerged days after Binance hot wallets were hacked. The FBI attributed that hack to the North Korean TraderTraitor group and said about $6.4 billion was stolen from Binance. That context is separate from ZachXBT’s estimate of the European incident: the investigator said he did not believe Lazarus was responsible, citing laundering indicators. ZachXBT had published 11 wallet addresses he linked to the suspected theft, according to CoinDesk, without identifying the victim. Published reports through November 3 still lacked public confirmation from the entity suspected of being affected or identification of the exchanges involved.