An unidentified European Union-linked entity may have lost more than $106 million in cryptocurrency from accounts at several centralized exchanges on November 1, according to an on-chain investigation published by ZachXBT on November 2. The researcher says the suspected perpetrator withdrew USDC and USDT into a cluster of external wallets, then rapidly converted and moved portions of the funds through multiple services and blockchains.
The allegation is substantial but remains preliminary. The purported victim has not been publicly named, the relevant exchanges have not been identified, and no independently verified incident statement has confirmed an unauthorized withdrawal or the final net loss. ZachXBT’s fund-flow chart identifies 11 alleged theft addresses, but does not explain how the exchange accounts were accessed or publish a transaction-by-transaction reconciliation of the $106 million-plus estimate.
The strongest immediate finding is therefore a suspected cross-exchange account compromise and the speed of subsequent fund movements—not evidence that a particular exchange’s infrastructure was hacked. The distinction determines whose security controls may have failed and which institutions could possess information useful for tracing or recovery.
What does ZachXBT’s $106 million alert establish?
In a November 2 alert on his official investigations channel, ZachXBT described an unnamed EU entity as the possible victim of withdrawals totaling more than $106 million from multiple centralized exchange accounts the previous day. He said the suspected stolen assets were initially withdrawn as USDC and USDT.
The attached diagram depicts three source clusters labeled “Exchange 1,” “Exchange 2” and “Exchange 3,” with arrows to multiple purported receiving wallets. These are generic labels on the researcher’s chart, not an identification of three particular exchange companies or a verified account inventory. The diagram then traces a series of transfers toward aggregation addresses and destinations attributed to conversion services.
ZachXBT provided 11 Ethereum-format theft addresses. They include 0xADd95cD98E0288ba69785E3151E1db86adF8Dd58, 0x29e9D7715D935e0D0D4B0DD0efC952A97E551020 and 0x378B4f150707C283574DC89739608D29036D57d5. An address appearing in a research diagram is useful for reproducing a transfer trail but cannot, by itself, establish the person controlling the private key or who had authority to withdraw from an exchange account.
The $106 million-plus figure is ZachXBT’s estimated value of suspicious withdrawals. It should not be treated as a company-confirmed loss, a forensic finding endorsed by the affected exchanges or an amount necessarily still controlled by the suspected operator. The chart shows repeated movements of some assets through successive addresses and swaps; summing every arrow would double-count the same underlying value.
There is also no evidence yet in the public alert of how the suspected actor acquired the ability to withdraw. Possibilities such as stolen login credentials, compromised API permissions, account-recovery abuse, internal misconduct or an exchange security weakness require account-level logs and other off-chain evidence. None can be selected simply from the existence of on-chain transfers.
How were USDC and USDT routed toward ETH and Monero?
ZachXBT described aggressive movement during the 24 hours following the suspected theft. According to the alert, the operator exchanged USDC for ether, transferred assets to instant exchange services including WellWallet and Kyrrex, converted some value into Monero through Wagyu and used bridges between chains. The associated chart shows multiple consolidation and onward-transfer paths rather than one direct payment from a single exchange to a final recipient.
That route changes what investigators can observe at each stage. On transparent blockchains, the withdrawal and subsequent transfers can be followed between visible addresses, subject to the quality of address attribution. A conversion through a centralized or instant-swap service creates an additional counterparty that may have internal customer, order and payout records not visible on-chain. Bridging may preserve a recognizable relationship between transactions on different networks, but not necessarily disclose the final beneficiary.
Monero adds a further layer of uncertainty because its privacy architecture conceals transaction details that are visible on public Ethereum-style ledgers. A traced deposit to a service associated with Monero conversion does not prove that every dollar from the suspected theft was successfully exchanged into XMR, or that the investigator can follow each later XMR transfer. Likewise, an ETH swap is not an additional theft: it is another form of the same value after conversion, potentially affected by market prices and fees.
Importantly, identifying WellWallet, Kyrrex or Wagyu as transaction destinations does not show that their operators knew the funds were allegedly stolen, approved unlawful transactions or participated in the initial loss. Their inclusion is an investigator’s address or service attribution. Establishing what each provider saw and did would require verified account records, timestamps and responses from the relevant businesses.
A separate DaveFinances investigation into more than $20 million in suspected illicit flows through FreedomXMR illustrates why exchange deposits, conversion infrastructure and allegations of operator complicity must be evaluated independently. FreedomXMR is not identified in the new $106 million chart as the destination of this theft; the earlier case provides context about conversion models, not a demonstrated connection between the two incidents.
Why does ZachXBT say the attacker is not Lazarus Group?
The researcher said he had a high degree of confidence that the unidentified operator was not Lazarus Group, citing multiple indicators in the laundering behavior. He did not publicly enumerate those indicators in the short alert. His assessment should therefore be treated as an informed but unexplained attribution judgment, not a confirmed identity or a definitive exclusion of every North Korean-linked actor.
The distinction is especially important because a highly publicized October 29 attack on Binance has been attributed to North Korea-linked TraderTraitor by US authorities. There is no established connection between that incident and the purported November 1 EU-account theft. Timing, large dollar values and the appearance of common crypto assets are not evidence of a shared attacker.
Some investigative comparisons may focus on the order of swaps, preferred bridges, choice of intermediaries, timing or use of privacy-oriented assets. Such behavioral signals can inform hypotheses but are not unique identifiers. A different actor may copy an established laundering technique, while the same actor can change its methods. Without device forensics, infrastructure records or other corroboration, a transaction pattern alone rarely proves a human or state attribution.
DaveFinances previously covered ZachXBT’s undercover investigation of a suspected Lazarus-linked laundering network. That reporting distinguished direct transaction matches from statements made by alleged intermediaries. The new alert makes a contrasting attribution claim; it does not supply enough published detail to place the EU incident within, or conclusively outside, any particular network.
Could issuers and exchanges still intercept the funds?
The initial use of USDC and USDT matters because their issuers can restrict transfers at designated token addresses on supported chains. Such controls may be valuable when verified stolen funds remain in an identifiable wallet. The window can narrow quickly if the operator converts those tokens into native ETH, moves them to an exchange-controlled address, crosses into other networks or obtains Monero.
That does not mean funds routed through an instant exchange are automatically irrecoverable. A regulated provider may be able to freeze an account balance or preserve transaction records if it receives adequate notice and has technical or legal authority to act. Nor would a token freeze guarantee restitution: a balance immobilized in a wallet is different from money legally returned to the original owner.
DaveFinances’ analysis of $6.4 billion in historical stablecoin freezes found that the timing of intervention and public attribution can be as consequential as the token issuer’s technical power. Those historical statistics do not provide a current freeze total for this new case.
No issuer blacklist action, asset seizure, confirmed refund or recovered-funds amount was specified in ZachXBT’s November 2 alert. Nor has the affected entity publicly quantified its exposure, identified the exchanges involved, described the security failure or said whether customer assets were included. Consequently, reporting the full $106 million estimate as irretrievably lost or as already laundered into Monero would overstate the evidence.
The next meaningful disclosures would be a statement from the alleged victim, acknowledgments from the exchange providers involved, a reconciled list of originating withdrawal transactions and verified balances still held by identifiable counterparties. Together, those records could distinguish an account takeover from an internal transfer, validate the loss estimate and establish what portion might still be recoverable.
For investors and institutional custodians, the central risk is cross-platform access control. An entity using several exchanges may hold separate balances but share staff, credentials, approval processes or operational devices across them. That is a plausible common-failure scenario, not a demonstrated cause of this case. The public record currently supports a carefully attributed warning about more than $106 million in suspected suspicious withdrawals and complex follow-on transfers—not a confirmed breach of named exchanges or a verified attribution of the person behind them.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574