ZachXBT: EU entity suspected of losing $106M from exchange accounts

On-chain investigator ZachXBT says an entity based in the European Union is suspected of losing more than $106M from multiple centralized exchange accounts. According to his Telegram alert, posted Nov 2, an attacker withdrew the funds on Nov 1 as USDC and USDT. Neither the victim nor the exchanges involved have been named.

Details

ZachXBT says that over the 24 hours after the theft the attacker aggressively swapped USDC for ETH, moved funds to instant exchanges (he names WellWallet and Kyrrex), converted part into Monero via Wagyu and bridged assets across several chains. He listed 11 Ethereum addresses linked to the theft.

The attacker is unidentified. ZachXBT says he can state with a high degree of confidence it is not North Korea's Lazarus Group, based on multiple laundering indicators. Decrypt reports the same. Neither the victim nor the exchanges have publicly confirmed the incident, so the figure remains the investigator's estimate.

What it means for the market

It is the second major exchange-related security story in days, after the Binance hack. From the description this looks like account access rather than a breach of the exchanges themselves. Because the funds left as stablecoins, issuers could in theory freeze addresses, so the key question is whether that happens before conversion to ETH and Monero. Until the parties confirm, treat the amount as preliminary. For the live bitcoin price, see the daily brief.