$106M Vanishes Into the Privacy Coin Pipeline as a $786K Solana Bot Takes a Hit

An unidentified entity in the European Union may have lost more than $106 million from accounts at multiple cryptocurrency exchanges on Sunday, according to blockchain investigator ZachXBT. The suspected stolen funds were withdrawn in USDC and USDT before moving through several cryptocurrencies and blockchains, with 11 wallet addresses identified in connection with the incident.

ZachXBT said the suspected attacker swapped USDC for Ether (ETH), used instant exchange services including WellWallet and Kyrrex, and converted funds into Monero (XMR) through the swap service Wagyu. The investigator said the movement of funds indicated that the culprit was likely attempting to obscure the origin of the assets, adding that he could say “with a high degree of confidence” that it was not Lazarus Group. The affected entity and exchanges involved have not been publicly named, and it remains unclear whether any funds have been frozen.

The reported theft came after the $6.3 billion Binance hack on Oct. 29, which the FBI attributed to North Korean hackers known as “TraderTraitor,” a group linked to Lazarus. Another report described the Binance theft as roughly $6.4 billion and said Tether froze stolen USDT on Ethereum in 37 minutes, while Circle froze all $823 million in stolen USDC, helping lock up about 44% of the haul, according to blockchain analytics firm Elliptic.

Separately, a wallet associated with King, an automated arbitrage bot on Solana, may have lost about $786,000 on Monday, according to pseudonymous blockchain monitoring account Onchain Lens. Onchain Lens told Cointelegraph that the funds moved through several Solana wallets before being transferred to Ethereum using Mayan, a service for moving assets between blockchains, and added: “Our report is based on unusual fund movements, rapid transfers and the subsequent cross-chain movement of funds, which we believe indicates an attempt to obscure their origin.” The account further said, “This pattern strongly suggests a potential wallet compromise,” though King’s operator has not confirmed a compromise.