EU Entity May Have Lost $106M From Exchange Accounts, ZachXBT Traces Route

The trail then moved into Monero (XMR), a privacy-focused cryptocurrency that conceals transaction details that most public blockchains expose. Crypto Briefing says the research points to Wagyu as the venue for that conversion. CoinDesk's account describes the attacker moving funds through ether, instant exchanges and Monero, but does not name the Monero venue. After the Monero step, the funds were reportedly sent through cross-chain bridges, tools that move value between blockchains. Eleven addresses tied to the incident have been publicly identified.

Open Questions About the Victim and Method

Neither source names the victim beyond stating that it is based in the EU, and neither has disclosed how the attacker gained access to the accounts. Losses spread across several exchanges raise questions about how one intrusion, or a series of them, reached multiple platforms, but no explanation has been made public.

CoinDesk's headline describes the matter as suspected, and the sourcing supports that framing: the loss figure has not been independently confirmed by the victim or the affected exchanges, which remain unidentified in the public record.

Recovery Prospects and What to Watch

The public-ledger legs of the route, the stablecoin withdrawals and the ETH swaps, are what allowed the tracing. The Monero conversion and bridge routing are where, according to the research, public tracing becomes far harder and recovery becomes complex. That is a plausible reason the attacker moved funds into that channel.

Three developments are worth tracking: whether the victim is identified and explains the breach, any movement from the eleven flagged addresses that could give investigators new leads, and how the exchanges and swap services named in the tracing respond. Both sources point to the instant exchange services as likely to face scrutiny over how they handled large, fast-moving inflows from a flagged source.

Why It Matters

For Traders

Exchange accounts and swap venues named in the trail may face freezes or added scrutiny, so counterparties on those platforms could see short-term operational friction.

For Investors

A theft of this size routed into a privacy coin highlights custody and exchange-security risk as a recurring factor in platform due diligence.

For Builders

Instant swap services and bridges that accept large, fast inflows from flagged addresses show why sanctions screening and rapid flagging belong in the transaction path.