Unnamed EU Entity Loses $106M in Exchange Account Theft, Not Linked to Lazarus Group
Blockchain investigator ZachXBT flagged a suspected theft of more than $106 million from multiple centralized exchange accounts of an unnamed EU entity, with funds withdrawn as USDC and USDT. Investigators say the activity shows multiple laundering indicators inconsistent with North Korea's Lazarus Group, which was linked to the Binance hack.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
The Suspected Theft
Blockchain investigator ZachXBT reported a suspected theft of more than $106 million from several centralized exchange accounts belonging to an unnamed European Union entity. Sources differ on timing: CryptoPotato says the funds were taken on November 1, while Decrypt says the withdrawals occurred on Sunday, which would also fall on November 1. Both outlets say the assets were withdrawn as USDC and USDT stablecoins by what ZachXBT called an "illicit actor."
The victim has not been named, and the attacker has not been identified.
How the Funds Were Moved
According to ZachXBT's findings, the attacker moved quickly over the following 24 hours. The funds were converted from USDC into ETH and routed through instant exchange services WellWallet and Kyrrex. Some assets were then converted into Monero (XMR) through Wagyu, a non-custodial, cross-chain instant exchange and bridge focused on privacy assets. The funds were also bridged across several blockchains.
Both outlets note that the choice of venues matters. Instant exchanges typically allow swaps with limited identity verification, and Monero obscures senders, receivers and amounts. Decrypt also points out that moving out of USDC and USDT is significant because the issuers of those stablecoins can freeze tokens, so exiting them reduces the chance of a freeze.
Attribution and Disagreement
ZachXBT said he is highly confident the activity is not linked to Lazarus Group, the umbrella name for North Korea's state-backed hackers, citing multiple laundering indicators. Neither source reports that the actor has been identified, so attribution remains open.
The contrast with the Binance hack is notable. The FBI has attributed the $6.3 billion to $6.4 billion Binance theft to TraderTraitor, a North Korean group. Reports differ on the size of that hack: CryptoPotato cites $6.3 billion, while Decrypt cites $6.4 billion. In that case, Tether froze stolen USDT on Ethereum within 37 minutes and Circle froze all $823 million in stolen USDC, which Elliptic says helped lock up about 44% of the haul. Decrypt reports that the remaining funds were spread across about 12,000 wallets. Neither source reports whether any funds from the EU entity theft have been frozen.
Wider Security Incidents
The EU case came days after the Binance hack and alongside other security events. Brazilian exchange Mercado Bitcoin reported a security incident involving more than $40 million in suspicious outflows across 10 networks, including Bitcoin, Ethereum and Solana. Blockchain security firm Hypernative flagged the outflows, according to the local outlet BitNotícias as cited by CryptoPotato. Mercado Bitcoin later confirmed the incident, said it had contained it, and stated that customers were unaffected and no data breach occurred. It temporarily suspended deposits and withdrawals while investigating. Decrypt reports the exchange halted withdrawals after the hack.
Separately, BTCPay Server is investigating reports that attackers swept hot wallets on older instances, affecting versions 2.4.1 and earlier after attackers reportedly gained admin access. The platform says it has no credible reports of hot wallet drains on the latest 2.4.7 release and has urged users to update. Decrypt reports that BTCPay told merchants to switch off their servers amid the reports.
Why It Matters
For Traders
Stablecoin exits from USDC and USDT show how quickly attackers can move funds, so watch for issuer freezes and exchange withdrawal halts on affected venues.
For Investors
Repeated nine-figure thefts in a single week raise questions about custody and exchange security that may weigh on sentiment toward centralized platforms over coming months.
For Builders
Hot wallet exposure on older BTCPay versions shows that patch lag creates real risk, so teams running self-hosted payment infrastructure should audit and update their deployments now.
This article is for information only and is not financial advice. Read the full disclaimer.
