ZachXBT Reports Possible $106 Million Theft at EU Entity
ZachXBT sees rapid movement through USDC, ETH, and Monero, using instant-exchange services like Kyrrex and WellWallet. The origin of the EU entity and the attack method are still unclear.
Key Takeaways
- ZachXBT says an unknown EU organization may have lost $106 million on November 1 through accounts at multiple crypto exchanges.
- BeInCrypto saw about $80 million in USDC move to 11 wallets within 11 hours, with some of it moved again within three minutes.
- The funds were partly converted to ETH and Monero, making the money trail harder for researchers to trace.
An unknown organization in the European Union is said to have lost more than $106 million (€94.5 million) on November 1 through accounts at multiple crypto exchanges. According to blockchain researcher ZachXBT, the funds were then moved within minutes, making the money trail harder to follow.
Fast Money Movement
BeInCrypto’s analysis of Ethereum transactions shows that about $80 million (€71.3 million) in USDC went to 11 wallets within 11 hours. In five of those wallets, about $9.6 million (€8.6 million) was then moved out again within three minutes. The $106 million (€94.5 million) figure also includes USDT, a stablecoin that, like USDC, is pegged to the dollar.
The suspected attacker is said to have converted USDC into ETH and then used instant-exchange services, including WellWallet and Kyrrex. Some of the funds were converted through Wagyu into Monero, a coin that hides transaction details and makes forensic analysis harder.
Why Monero Matters
Monero uses techniques that make transactions less visible, such as ring signatures and stealth addresses. That makes it harder for researchers to track money once funds have been moved there. In this case, amounts were also sent back and forth between different blockchains.
Notably, at least five flagged wallets had already received smaller payments from the same source earlier. That raises questions about where the accounts came from, but it still says nothing about when or exactly how a possible breach happened.
What This Means for Users
There is still no public evidence that regular EU customers of crypto exchanges were affected by a broader hack. Even so, this case shows how quickly stolen funds can move between wallets, exchanges, and privacy tools. For European crypto users, the main takeaway is that incidents like this often only become visible late, by which point most of the money has already been moved. Earlier exchange incidents also showed how quickly attackers can spread funds across multiple blockchains and wallets, such as in the cross-chain attack at Coinsbuy.