A $133M crypto heist unfolded—then $78.3M apparently decided to stick around

Blockchain investigator ZachXBT raised his estimate of a suspected theft from an unidentified European Union entity to more than $133 million, saying on Tuesday that he found another $27 million withdrawn from centralized exchanges after his initial Monday disclosure. “My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up,” ZachXBT said. The victim’s identity and the alleged cover-up remain unverified, but ZachXBT said the lack of proper incident disclosure allowed more than $30 million to be laundered and that EU law enforcement could otherwise have frozen the funds.

ZachXBT identified 11 Ethereum addresses linked to the suspected attacker, who withdrew USDC and USDT before swapping some USDC for ETH, using instant exchanges including WellWallet and Kyrrex, converting funds into Monero (XMR) through Wagyu, and moving assets across multiple blockchains. Bitquery reported that $62.98 million in stablecoins was converted into 27,553 ETH within roughly four hours. As of 13:47 UTC Monday, approximately $78.3 million remained in wallets linked to the suspected attacker, $30.5 million had moved out of the tracked addresses, and only $3.74 million remained in USDC that issuer Circle could potentially freeze. ZachXBT said the laundering pattern did not match those typically used by North Korea’s Lazarus Group.

The suspected theft came after the reported $6.3 billion Binance hack on Oct. 29, which the FBI attributed to North Korean hackers known as “TraderTraitor,” a group linked to Lazarus; another report put the Binance loss at roughly $6.4 billion and described the attack as occurring on Thursday. Tether froze stolen USDT on Ethereum in 37 minutes, while Circle froze all $823 million in stolen USDC, helping lock up about 44% of the haul, according to Elliptic. North Korean launderers reportedly spread the remaining funds across about 12,000 wallets.

A separate wallet associated with King, an automated arbitrage bot on Solana, may have lost about $786,000 on Monday, according to pseudonymous blockchain monitoring account Onchain Lens. Onchain Lens said the funds passed through several Solana wallets before being transferred to Ethereum using Mayan, with the operator yet to confirm a compromise. “Our report is based on unusual fund movements, rapid transfers and the subsequent cross-chain movement of funds, which we believe indicates an attempt to obscure their origin,” Onchain Lens told Cointelegraph. “This pattern strongly suggests a potential wallet compromise.”

The incidents followed other reported security disruptions, including Brazilian exchange Mercado Bitcoin halting withdrawals after a $40 million hack and BTCPay Server telling merchants to switch off their servers amid reports of hot wallet attacks. It remains unclear whether any funds from the suspected EU theft have been frozen, and the attacker or attackers remain unidentified.