In brief
- An unnamed EU entity is suspected of losing more than $106 million from multiple centralized exchange accounts on Nov. 1, ZachXBT said, with the funds withdrawn as USDC and USDT.
- The thief has since swapped stablecoins for ETH, used instant exchanges, converted funds to Monero and bridged assets across chains.
- ZachXBT said with “a high degree of confidence” that the attacker isn‘t North Korea’s Lazarus Group, setting the theft apart from the $6.4 billion Binance hack.
Another nine-figure theft has hit crypto, just days after the biggest heist in the industrys history.
An unnamed entity in the European Union is suspected of losing more than $106 million from several of its accounts on centralized exchanges on Sunday, pseudonymous onchain investigator ZachXBT said Monday in a post to his Telegram channel.
The funds were withdrawn as USDC and USDT stablecoins by what he called an “illicit actor.”
Predict·CryptoSOL next move: Pump to $160 or Dump to $40？
46%
54%
$160$40
$22.26K volume
HITOpen until resolution
Open until resolution
In the 24 hours that followed, the actor moved aggressively to cover their tracks, ZachXBT said. The attacker swapped USDC for ETH, sent funds through instant exchange services such as WellWallet and Kyrrex, converted some to the privacy coin Monero via Wagyu and bridged assets across multiple blockchains.
ZachXBT published 11 Ethereum addresses tied to the theft.
Instant exchanges let users quickly swap one cryptocurrency for another, often with little identity verification, while Monero hides senders, receivers and amounts, making it a popular tool for obscuring stolen funds.
Swapping out of USDC and USDT also matters because the companies behind those stablecoins can freeze them.
BitcoinBTC · USD
$76,928−3.97%
24H7D1M1YYTD
Oct 26Oct 28Oct 30Nov 1Nov 2
$81.8k$80.1k$78.4k$76.7k
24h HighHigh$78,728
24h LowLow$76,611
VolVol$984.7M
→
Buy Bitcoin with USDC
Powered by Jupiter
$50$100$500
Buy
Price data by CoinGeckoCoinGeckoMore Bitcoin news and projections →
ZachXBT said the culprit remains unidentified, but that he could say “with a high degree of confidence” that it isn‘t Lazarus Group, citing multiple laundering indicators. Lazarus is the umbrella name often used for North Korea’s state-backed hackers. ZachXBT didnt name the victim.
That sets the theft apart from the record-setting $6.4 billion Binance hack, which the FBI has attributed to TraderTraitor, a North Korean hacking group.
In that case, stablecoin issuers moved within minutes. Tether froze stolen USDT on Ethereum in 37 minutes, and Circle froze all $823 million in stolen USDC, helping lock up about 44% of the haul, according to blockchain analytics firm Elliptic.
North Korea‘s launderers have since spread the remaining funds across about 12,000 wallets. It’s unclear whether any funds in the EU case have been frozen.
The incident adds to an already unprecedented week for crypto security. Beyond the record-breaking Binance hack, Brazilian exchange Mercado Bitcoin just today reported halting withdrawals after a $40 million hack of its own. Likewise today, BTCPay Server told merchants to switch off their servers amid reports of hot wallet attacks.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
Email addressJoin free
Join 72,000+ readers
Create an account to save your articles.
Add on Google
Add Decrypt as your preferred source to see more of our stories on Google.