Key Highlights
- Blockchain investigator ZachXBT has raised the estimated scale of a suspected crypto theft linked to an unidentified European entity to more than $133 million, after tracing over $27 million in additional suspicious withdrawals from centralized exchanges.
- ZachXBT’s working theory is that a large Western European financial institution was compromised and is concealing the incident.
- The report comes amid a wave of major crypto security incidents in recent weeks, including Binance’s roughly $6.3 billion hot-wallet breach attributed to a North Korea-linked group.
Blockchain investigator ZachXBT has raised the estimated scale of a suspected cryptocurrency theft linked to an unidentified European entity to more than $133 million. He identified over $27 million in additional suspicious withdrawals from centralized exchanges, some of which occurred after his initial public disclosure.
ZachXBT’s working theory is that a large financial institution in Western Europe was compromised and is concealing the incident. He said the lack of timely disclosure allowed more than $30 million to be laundered, funds that EU authorities might otherwise have frozen. The victim’s identity and exact losses remain unconfirmed.
What ZachXBT Reported
On November 2, ZachXBT issued a community alert stating that an EU entity was suspected of losing more than $106 million from multiple centralized exchange accounts on November 1. The funds were withdrawn primarily as USDC and USDT.
The suspected attacker quickly swapped stablecoins for Ether, moved value through instant exchange services, converted portions to the privacy coin Monero, and bridged across chains. ZachXBT published a list of addresses linked to the activity and stated with high confidence that the pattern did not match North Korea’s Lazarus Group based on laundering indicators.
In a November 3 update, he reported tracing an additional $27 million-plus in centralized exchange withdrawals by the same actor, pushing the total linked amount above $133 million. Some of those withdrawals happened after the first disclosure. “My working theory is a large financial institution in Western Europe was exploited, and it’s currently being covered up,” ZachXBT wrote on Telegram. He criticised the absence of proper incident disclosure, saying it resulted in more than $30 million being laundered that EU law enforcement could potentially have frozen.
Blockchain analytics from Bitquery aligned with parts of the tracing: roughly $63 million in stablecoins was converted into more than 27,000 ether in a short window, with tens of millions still observable in related wallets at certain checkpoints. No institution has confirmed the loss, and no official investigation details have been released publicly.
Wave of Major Crypto Security Incidents
The report arrives amid a series of large-scale security events that have hit the crypto sector in recent weeks. On October 29, Binance disclosed a breach involving unauthorized withdrawals from hot wallets totalling approximately $6.3 billion across multiple blockchains.
The exchange said initial findings pointed to a compromised engineer’s laptop among other factors, found no evidence of private key leaks from wallets themselves, suspended withdrawals temporarily, and pledged to cover all losses with its Secure Asset Fund for Users and corporate reserves. Partners helped freeze roughly $3 billion in assets. The FBI later attributed the attack to a North Korea-linked group.
Earlier in October, hardware wallet users suffered a supply-chain compromise involving Ledger devices sold through the authorized Southeast Asian reseller CryptoBilis. Criminals installed hidden implants that captured recovery phrases during setup. On-chain trackers estimated losses near $93 million across hundreds of wallets, mostly in USDT on TRON, with smaller amounts on Bitcoin, Ethereum, and other chains. Ledger confirmed at least one device contained an unauthorized implant and advised affected customers.
Indian exchange CoinDCX confirmed a separate $16 million loss in late October. Approximately 15.99 million USDT was drained from wallets the platform said it had retired after a prior incident. The exchange absorbed the loss and stated customer funds on active systems remained safe, though the episode drew scrutiny over wallet management practices.
