conv.

All stories
SecurityQuiet 8d · day 9

ZachXBT flags $106M crypto theft from EU entity; laundering trail tracked

Blockchain investigator identifies suspected theft from unnamed EU organization; attacker moves funds through ETH swaps and privacy mixers.

newest coverage 8d agosummary written 8d ago2 pieces Newswires

What to know

  • Blockchain investigator ZachXBT identified a $106M suspected theft from an unnamed EU entity's exchange accounts, with funds laundered through multiple swaps and privacy tools.
  • The attacker converted USDC/USDT to ETH, routed through instant exchanges (WellWallet, Kyrrex), and converted to Monero—a privacy coin—for final obscurement.
  • ZachXBT ruled out Lazarus Group involvement based on laundering patterns, but the victim entity and affected exchanges remain publicly unidentified.
  • The incident is the latest in a series of crypto security breaches, including a reported $40M incident at Mercado Bitcoin and ongoing BTCPay Server vulnerabilities.

“According to his findings, the stolen funds were withdrawn in USDC and USDT before the attacker began aggressively swapping USDC for ETH, moving funds through instant exchanges such as WellWallet and Kyrrex, and converting them into XMR through Wagyu.”

CryptoPotato describing ZachXBT findings · CryptoPotato ↗

ZachXBT Blockchain investigatorUnidentified EU entity Suspected theft victim

ZachXBT flags $106M crypto theft from EU entity; laundering trail tracked
cryptopotato.com

How it unfolded 2 developments, newest first · click a bar or a number to jump articles

Peak 1 piece in two hours at Nov 2, 11 AM; 2 pieces over 9 days (2 articles) Nov 2, 11 AM — 1 piece · 1 article — Newswires 1Nov 2, 1 PM — quietNov 2, 3 PM — quietNov 2, 5 PM — 1 piece · 1 article — Newswires 1Nov 2, 7 PM — quietNov 2, 9 PM — quietNov 2, 11 PM — quietNov 3, 1 AM — quietNov 3, 3 AM — quietNov 3, 5 AM — quietNov 3, 7 AM — quietNov 3, 9 AM — quietNov 3, 11 AM — quietNov 3, 1 PM — quietNov 3, 3 PM — quietNov 3, 5 PM — quietNov 3, 7 PM — quietNov 3, 9 PM — quietNov 3, 11 PM — quietNov 4, 1 AM — quietNov 4, 3 AM — quietNov 4, 5 AM — quietNov 4, 7 AM — quietNov 4, 9 AM — quietNov 4, 11 AM — quietNov 4, 1 PM — quietNov 4, 3 PM — quietNov 4, 5 PM — quietNov 4, 7 PM — quietNov 4, 9 PM — quietNov 4, 11 PM — quietNov 5, 1 AM — quietNov 5, 3 AM — quietNov 5, 5 AM — quietNov 5, 7 AM — quietNov 5, 9 AM — quietNov 5, 11 AM — quietNov 5, 1 PM — quietNov 5, 3 PM — quietNov 5, 5 PM — quietNov 5, 7 PM — quietNov 5, 9 PM — quietNov 5, 11 PM — quietNov 6, 1 AM — quietNov 6, 3 AM — quietNov 6, 5 AM — quietNov 6, 7 AM — quietNov 6, 9 AM — quietNov 6, 11 AM — quietNov 6, 1 PM — quietNov 6, 3 PM — quietNov 6, 5 PM — quietNov 6, 7 PM — quietNov 6, 9 PM — quietNov 6, 11 PM — quietNov 7, 1 AM — quietNov 7, 3 AM — quietNov 7, 5 AM — quietNov 7, 7 AM — quietNov 7, 9 AM — quietNov 7, 11 AM — quietNov 7, 1 PM — quietNov 7, 3 PM — quietNov 7, 5 PM — quietNov 7, 7 PM — quietNov 7, 9 PM — quietNov 7, 11 PM — quietNov 8, 1 AM — quietNov 8, 3 AM — quietNov 8, 5 AM — quietNov 8, 7 AM — quietNov 8, 9 AM — quietNov 8, 11 AM — quietNov 8, 1 PM — quietNov 8, 3 PM — quietNov 8, 5 PM — quietNov 8, 7 PM — quietNov 8, 9 PM — quietNov 8, 11 PM — quietNov 9, 1 AM — quietNov 9, 3 AM — quietNov 9, 5 AM — quietNov 9, 7 AM — quietNov 9, 9 AM — quietNov 9, 11 AM — quietNov 9, 1 PM — quietNov 9, 3 PM — quietNov 9, 5 PM — quietNov 9, 7 PM — quietNov 9, 9 PM — quietNov 9, 11 PM — quietYesterday, 1 AM — quietYesterday, 3 AM — quietYesterday, 5 AM — quietYesterday, 7 AM — quietYesterday, 9 AM — quietYesterday, 11 AM — quietYesterday, 1 PM — quietYesterday, 3 PM — quietYesterday, 5 PM — quietYesterday, 7 PM — quietYesterday, 9 PM — quietYesterday, 11 PM — quietToday, 1 AM — quietToday, 3 AM — quiet 1–2
Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9yesterdaynow · 5:43 AM ET
  1. 2

    ZachXBT rules out Lazarus Group based on laundering indicators

    ZachXBT stated high confidence the attacker is not the North Korean threat actor Lazarus Group, based on multiple indicators in how the funds were laundered and moved across chains.

    “Although the actor remains unidentified, ZachXBT said he is highly confident the activity is not linked to the North Korean threat actor Lazarus Group, based on multiple laundering indicators.”
    — ZachXBT
    1. 1 outlet Over $106M in Crypto Stolen From EU Entity? ZachXBT Tracks Attacker's Laundering Trail

      first by CryptoPotato, 8d ago

  2. 1

    ZachXBT publishes laundering trail analysis

    ZachXBT documented the attacker's fund movements through ETH swaps, instant exchanges (WellWallet and Kyrrex), and conversion to Monero. The victim and affected exchanges remain unidentified.

    “The unidentified attacker moved funds through ether, instant exchanges and Monero, but the victim and affected exchanges remain unknown.”
    — CoinDesk reporting on ZachXBT findings
    1. 1 outlet EU entity suspected of losing $106 million from crypto exchange accounts, ZachXBT says

      first by CoinDesk, 8d ago

  3. background

    Suspected $106M theft from EU entity's exchange accounts detected — Blockchain investigator ZachXBT flagged a suspected theft of more than $106 million involving multiple centralized exchange accounts linked to an unnamed EU entity. The stolen funds were withdrawn in USDC and USDT.