According to CoinDesk, an unidentified EU-based entity may have lost more than USD 106 million in cryptoassets held in accounts at several cryptocurrency exchanges on Sunday, according to blockchain investigator ZachXBT. The losses have not been independently confirmed, and neither the victim nor the exchanges involved have been named. The term ‘entity’ could refer to a range of organisations, including a company, a trading firm, or an investment fund. ZachXBT did not specify which type of organisation was affected.
How the funds were moved
In a Telegram alert published on Monday, 2 November 2026, ZachXBT said the suspected attacker withdrew the funds in USDC and USDT, two US dollar-pegged stablecoins. The funds were then routed across several cryptocurrencies and blockchains.
Over the following 24 hours, the attacker reportedly swapped USDC for ether (ETH), moved funds through instant-exchange services including WellWallet and Kyrrez, and used Wagyu to convert part of the proceeds into Monero (XMR).
The choice of assets matters for recovery efforts. USDC and USDT can be frozen by their issuers, but either and Monero have no central issuer able to freeze them. Monero also obscures transaction details, so stolen funds are harder to trace once they are converted. The reported timeline shows how little time stablecoin issuers may have to act before funds are moved into assets they cannot freeze.
ZachXBT published 11 wallet addresses linked to the suspected theft. The announcement did not mention the victim or the affected exchanges, and it did not explain how the attacker gained access to the accounts.
Attribution and wider context
The attacker has not been identified, but ZachXBT ruled out one prominent suspect. The investigator was highly confident that North Korea’s Lazarus Group was not responsible, citing several laundering indicators.
That assessment separates the incident from a larger attack days earlier. Hackers stole about USD 6.4 billion from Binance, an attack the FBI attributed to North Korea’s TraderTraitor group, which is associated with Lazarus.
Other incidents followed the Binance exploit. BTCPay, a bitcoin payment tool, told users to switch off their servers after reports of drained wallets. In addition, Brazil-based Mercado Bitcoin halted withdrawals after an apparent theft of about USD 40 million across ten chains.
Taken together, these events point to several security incidents within a short period, affecting centralised exchanges, payment infrastructure, and institutional account holders. The latest case differs in one respect: the losses are spread across accounts at several exchanges rather than drawn from a single platform. That spread complicates public attribution and coordinated freezing efforts.
Neither the EU entity nor any of the exchanges involved has publicly confirmed the suspected theft.
