Crypto Exchange Theft: ZachXBT Raises EU Loss Estimate to $133M
ZachXBT Flags $106M Lost by an Unnamed EU Entity
Crypto news today follows a suspected crypto exchange theft that on-chain investigator ZachXBT flagged on November 2, 2026. According to his alert, an unnamed entity based in the European Union lost more than $106 million in USDC and USDT.
The money left accounts at several centralized exchanges on Sunday, November 1.
The investigator raised the figure on November 3 to more than $133 million.
He identified about $27 million in related withdrawals, some made after his first public disclosure. Both updates appear in the ZachXBT Telegram channel, his primary outlet for the alerts.
How the Funds Moved: ETH Swaps, Instant Exchanges, and Monero
The attacker pulled the money out as stablecoins, then moved quickly. Within about 24 hours, the actor swapped USDC into ETH. Instant-exchange services, which swap assets fast and without account sign-up, handled part of the flow. WellWallet and Kyrrex were named.
Portions were then converted into Monero (XMR), a privacy coin, through a service identified as Wagyu. Assets were also bridged across several chains.
Source: CryptosRus Official X Post
Crypto Exchange Theft Tracing: What Bitquery Found On-Chain
Bitquery’s independent tracing counted about $108.8 million in USDC withdrawn from accounts at Kraken, Crypto.com, and OKX. This happened over roughly 21 hours on November 1 and 2.
Most of it first went to addresses those platforms had paid before, which points to wallets the victim already used. The full tracing is in the Bitquery investigation.
About $62.98 million in stablecoins became roughly 27,553 ETH within four hours, mainly through UniswapX, a decentralized swap tool. That implies about $2,286 per ETH. By early November 3, tens of millions still sat on Ethereum, mostly as ETH.
Tether froze some USDT. Circle had not frozen the remaining USDC when Bitquery took its snapshot.
Figure | Amount | Source |
First estimate (Nov 2) | $106M+ | Telegram alert |
Updated estimate (Nov 3) | $133M+ | Telegram update |
USDC withdrawn in 21 hours | about $108.8M | Bitquery |
Stablecoins swapped to ETH | $62.98M (27,553 ETH) | Bitquery |
The two totals do not match exactly, and neither source fully explains the gap.
Why ZachXBT Rules Out Lazarus and Suspects a Cover-Up
He is highly confident North Korea’s Lazarus Group was not involved, because the laundering indicators did not match its usual patterns. His working theory, shared on Telegram, is that a large Western European financial institution was exploited and that the incident is being covered up?
He says slow disclosure let over $30 million be laundered that EU law enforcement might have frozen. These claims remain unverified.
Bitquery’s reading of the crypto exchange theft differs in method. It suggests the attacker held the exchange logins and private keys to some wallets the victim used.
That points to an owner-side compromise, not an exchange-side hack, much like the customer-side exposure in the Keystone data breach.
What Exchanges Said and What Still Remains Unverified
Crypto.com said it had acted to block related funds and that its platform and user funds remained secure. OKX said it was looking into the matter. Kraken had not published a detailed response at the time of writing.
No victim has come forward, and the method of initial access is not public. Last week also brought the Polymarket security incident, a separate case.
This crypto exchange theft remains suspected, so the totals may still change. The Telegram channel and the Bitquery report are the primary sources to watch for the next update. Readers following the latest news should treat early figures with care, as with the Binance security incident.
Disclaimer: This article is for educational and informational purposes only and should not be considered financial or investment advice. Always conduct your own research before making investment decisions.
