Crypto Theft: $106M Stolen From EU Entity's Exchange Accounts

By Nodora News · 3 November 2026

ZachXBT says an EU entity may have lost over $106M in a crypto theft from exchange accounts, with stablecoins swapped into Ethereum (ETH) and Monero.

An unnamed organisation in the European Union may have lost more than $106 million in crypto from accounts at several centralized exchanges on Sunday, November 1, according to on-chain investigator ZachXBT. The suspected thief withdrew the money as the stablecoins USDC and USDT, then quickly swapped much of it into Ethereum (ETH) and pushed part of it into Monero (XMR), a privacy coin that is far harder to trace. Neither the victim nor any exchange has confirmed the loss so far.

Key takeaways

• ZachXBT flagged a suspected theft of more than $106 million from an unnamed EU entity's exchange accounts on November 1.
• The funds left as USDC and USDT, were swapped into ETH, and some were converted into Monero and bridged across chains.
• ZachXBT published 11 linked wallet addresses and said he is highly confident North Korea's Lazarus Group is not behind it.
• The victim, the exchanges involved and how the accounts were accessed remain unknown, and the loss has not been independently confirmed.

What happened in the suspected $106M crypto theft

ZachXBT shared the details in a community alert on his Telegram channel on Monday, November 2. He said an EU-based entity was suspected of losing more than $106 million from multiple centralized exchange accounts the day before. The word "entity" could mean a company, a trading firm or a fund; he did not say which.

According to the alert, the attacker withdrew the money in two US dollar-pegged stablecoins, USDC and USDT. Over the next 24 hours, the funds were moved fast and in several directions at once:

• USDC was aggressively swapped into ETH.
• Money was sent through instant-exchange services, including WellWallet and Kyrrex.
• Part of it was converted into Monero through a cross-chain swap service called Wagyu.
• Assets were bridged across multiple blockchains.

ZachXBT listed 11 Ethereum-style wallet addresses tied to the theft, so exchanges and swap services can screen incoming deposits against them.

The numbers so far

A fund-flow graph shared with the alert, credited to ZachXBT, the analytics firm TRM Labs and Specter, shows money leaving three accounts labelled only as "Exchange 1, 2 and 3". Reporting by Unchained and The Crypto Times describes these key figures from the graph:

• More than $106 million in total suspected losses.
• Individual USDC transfers ranging from roughly $245,000 to over $9.8 million.
• About $2.6 million in USDC routed into a cluster tagged as Wagyu, the Monero conversion route.
• Around 2,200 ETH sent to an address that then bridged funds onward.

No one has yet given a split between the USDC and USDT amounts, and it is not clear how much is still sitting in visible wallets.

Why the swap into ETH and Monero matters

Speed is the story here. USDC and USDT are issued by companies, Circle and Tether, that can freeze tokens held at flagged addresses. Tether did exactly that on Monday in the Mercado Bitcoin hack, locking about 4.5 million USDT.

Ether has no issuer that can freeze it, so every dollar swapped out of a stablecoin moves beyond that safety net. Monero goes further: it hides the sender, receiver and amount of each transaction by default. Once funds land there, following them on-chain becomes very difficult. That is why investigators race to publish addresses as early as possible.

ZachXBT also ruled out a familiar suspect. He said he can say "with a high degree of confidence" that the attack was not carried out by North Korea's Lazarus Group, based on laundering patterns, although he did not say what those patterns were. Lazarus has been linked to several of the largest crypto heists, including the recent record Binance hack.

The case also shows a different kind of risk from a classic exchange hack. Here the reported target was one customer's accounts spread across several exchanges, rather than an exchange's own hot wallets. Big holders who keep balances on exchanges may want to check withdrawal allowlists, API key permissions and two-factor settings.

Market reaction

The wider market barely moved on the news, which is typical when a theft involves stablecoins rather than an exchange's own reserves. According to OKX at the time of writing:

• Ethereum (ETH): about $2,253, down 0.5% over 24 hours.
• Bitcoin (BTC): about $77,000, down 1.2% over 24 hours.

The bigger concern is trust and security rather than prices, coming in a week already crowded with exchange incidents. You can follow live prices on the Nodora charts page.

What to watch next

Several basic questions are still open, and the answers will shape how big this story becomes:

• Who is the victim? A named fund or firm would confirm the loss and its true size.
• Which exchanges were involved, and how did the attacker get into the accounts: stolen API keys, a compromised employee, or something else?
• Freezes: whether Tether or Circle can lock any stablecoins still sitting in the flagged addresses.
• Swap services: whether WellWallet, Kyrrex or Wagyu held or turned away the incoming deposits.

Nodora will update coverage if the victim or exchanges come forward or if funds are frozen. This article is for information only and is not financial advice.

#Ethereum #Hack #Security #Monero #Stablecoins

This article is general information, not financial advice.