Blockchain investigator ZachXBT has raised his estimate of a suspected theft from an unidentified European Union entity to more than $133 million, after identifying over $27 million in additional withdrawals from centralized cryptocurrency exchanges. Some of the newly identified transactions took place after his first public warning on November 2, according to his November 3 update.
The revised figure is a materially new development in an incident that had initially been estimated at more than $106 million. It is not a company-confirmed financial loss, and the public evidence still does not identify the entity, the exchanges holding its accounts, or how the suspected operator gained withdrawal access. The researcher has also suggested the victim could be a major Western European financial institution that has not disclosed the incident, but he explicitly described that as a working theory.
The timing raises a practical question for investigators and trading counterparties: whether additional assets were removed while the suspected compromise was already publicly known, and what opportunities existed to interrupt those transfers before they were converted into less easily restricted assets.
What changed between the $106M alert and the $133M estimate?
ZachXBT’s initial November 2 alert described more than $106 million in suspected withdrawals, primarily USDC and USDT, from several centralized exchange accounts on November 1. The investigator’s November 3 follow-up added over $27 million in further withdrawals linked to the same suspected actor, taking his aggregate estimate above $133 million. These are cumulative amounts: the additional $27 million is included within the new total, not a separate loss to add on top.
In its original report on the suspected $106 million EU account theft, DaveFinances described a network of 11 investigator-attributed addresses and the movement of funds from exchange accounts through intermediary wallets, swap services and cross-chain routes. The new alert extends that initial reconstruction rather than establishing a second unrelated exploit.
The researcher added four alleged theft addresses: 0x5cf70edce65847ef989933c3072fb0e7f335abc1, 0xe378cdccb369a64a0190577787ef61ca2eefa6b2, 0x3e6c3d135ca8f8be793e5fe1715ce6c057d140f2 and 0x99d314e6970b8d3db0dbe6f6e041cc904143400f. That brings the publicly supplied list to 15 addresses. An address attribution is an investigative lead, not proof of ownership, the identity of the person who signed a transaction, or the original account compromise.
Crucially, a withdrawal observed after the initial public disclosure does not, on its own, demonstrate that an exchange was hacked, that the victim ignored a warning or that an institution knowingly allowed theft to continue. Establishing those conclusions would require the actual transaction times, exchange-side withdrawal approvals, relevant communications and records showing when responsible parties were informed.
How much was converted before a possible freeze?
ZachXBT said the suspected operator moved funds through instant exchanges, bridges and privacy-oriented assets, including Monero. In the November 3 update, he argued that more than $30 million had already been moved through laundering routes and could potentially have been frozen if authorities had received an earlier disclosure. This is the investigator’s assessment of a missed opportunity, not an independently established recoverable balance.
Separate on-chain analysis attributed to Bitquery identified a large conversion of approximately $62.98 million in stablecoins into 27,553 ETH through UniswapX over roughly four hours. Some early observers had interpreted the movement as a whale purchase before investigators linked the addresses to the suspected incident. The conversion figure describes the movement of assets already within the purported theft, not another $62.98 million taken in addition to the $133 million estimate.
A Bitquery snapshot taken at 13:47 UTC on November 2, as described in contemporaneous reporting, placed roughly $78.3 million in wallets linked by researchers to the operation and approximately $30.5 million as having moved onward from the addresses being tracked. Only around $3.74 million reportedly remained in USDC at addresses potentially eligible for issuer-level restrictions at that snapshot. Those are time-specific analytical figures, not verified balances as of November 3 and not a complete final reconciliation of the suspected incident.
USDC and USDT issuers can restrict specific token balances on supported networks, but that ability does not extend directly to native ETH or XMR. Even where a token has been frozen, immobilization is distinct from legal recovery and restitution to the original owner. DaveFinances previously examined the scale and limits of issuer-controlled stablecoin freezes, including why intervention timing and transaction sequencing change the amount that remains technically reachable.
None of the available disclosures shows that EU authorities had a confirmed victim report, reliable control over every destination address, or the legal and operational ability to halt the alleged $30 million in time. The contention that this entire sum would otherwise have been saved should therefore remain attributed to ZachXBT rather than treated as a demonstrated enforcement failure.
Is a Western European financial institution concealing a breach?
In his official investigations channel, ZachXBT described a major Western European financial institution as his working theory for the unidentified victim and alleged that the case was being concealed. The remarks are more specific than his first alert, which referred only to an entity in the European Union, but they do not identify a company, bank, fund or government institution.
No publicly verified statement from the alleged victim, its exchange counterparties, a regulator or law enforcement has confirmed that the entity is a financial institution or that anyone deliberately hid a known attack. Absence of an announcement alone cannot establish concealment: the organization’s identity, the relevant jurisdiction, the assets’ legal ownership, the reporting requirements and the status of any private investigation are unknown.
Likewise, multiple withdrawals from exchange accounts do not necessarily implicate the exchanges’ own wallets or security infrastructure. An attacker obtaining access to one institution’s accounts across several platforms could generate similar flows without compromising the exchanges themselves. Other possible explanations require evidence that is not available from token transfers alone.
The researcher previously said he had high confidence the operation was not associated with Lazarus Group, citing differences in laundering behavior without publishing the full indicators. That remains an attributed assessment, not a formal perpetrator identification. DaveFinances’ earlier reporting on ZachXBT’s separate Lazarus-linked laundering investigation offers context for attribution methods but does not demonstrate any connection to this case.
What evidence would confirm the loss and recovery prospects?
Three distinct questions remain open. First, did an identifiable entity experience unauthorized withdrawals, and from which exchange accounts? Second, can each transaction be linked to the same operation without counting subsequent swaps and bridge transfers multiple times? Third, how much value remains under the suspected actor’s control, has been restricted by issuers or intermediaries, or could be returned to a lawful claimant?
Those answers would require an incident notice from the victim or exchanges, verifiable originating withdrawal transactions, a clear explanation of account permissions and a current asset-flow reconciliation. Issuer blacklist records, exchange responses or law-enforcement notices could support more precise recovery estimates, but no such case-specific confirmation was established in the material reviewed for this update.
The newly identified post-alert withdrawals increase the urgency of those questions without settling them. The most defensible current account is that ZachXBT has expanded his estimate of suspicious exchange withdrawals from more than $106 million to over $133 million and published four additional addresses. His hypothesis of a concealed Western European institutional breach and his assessment that $30 million could have been frozen remain unproven.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574