Kraken Restricts Accounts as Suspected EU Crypto Theft Hits $133M

By Nodora News · 4 November 2026

Kraken has restricted accounts tied to a suspected $133M crypto theft from an EU entity, as most stolen USDC left through Kraken and was swapped into Ethereum.

Kraken has restricted accounts linked to a suspected crypto theft from an unnamed European Union entity, as the estimated loss climbed to more than $133 million on Tuesday, November 3, 2026. Blockchain investigator ZachXBT raised his tally from $106 million after tracing another $27 million in exchange withdrawals, and new onchain analysis shows most of the money left through ordinary Kraken withdrawals before much of it was swapped into Ethereum (ETH) and the privacy coin Monero (XMR).

Key takeaways

• The suspected theft from an unidentified EU entity is now estimated at more than $133 million, up from $106 million a day earlier.
• Kraken says it has restricted the accounts involved and is working with law enforcement, but stresses the incident did not start on its platform.
• Of about $108 million in USDC withdrawn on November 1 and 2, roughly $102 million came out of Kraken accounts, per Ledger Insights.
• About $63 million in stablecoins was converted into 27,553 ETH within roughly four hours, according to Bitquery.
• The victim has still not been named, and ZachXBT's view that a Western European financial institution is covering up a loss remains unconfirmed.

What happened in the suspected $133M EU crypto theft

The story first broke on Monday, when ZachXBT reported that someone had drained more than $106 million from several centralized exchange accounts belonging to what he described as an EU entity. Nodora covered that first alert in Crypto Theft: $106M Stolen From EU Entity's Exchange Accounts.

On Tuesday, ZachXBT posted a follow-up on his Telegram channel saying he had found more than $27 million in additional withdrawals by the same actor, lifting the estimate above $133 million. He added that some of those withdrawals happened after his first public warning, which suggests the accounts were still open and usable a day after the alarm was raised.

His working theory is that a large financial institution in Western Europe was hit and that the loss is being kept quiet. He has not named the institution or published evidence for the cover-up claim, and no institution, exchange or regulator has publicly confirmed a loss. That part of the story should be treated as an allegation for now.

How the money left: normal withdrawals, mostly from Kraken

The most striking detail is how unremarkable the mechanics appear. According to an analysis by Ledger Insights, nobody seems to have broken into a wallet or exploited a smart contract. Instead, someone with access to the exchange accounts appears to have used the standard withdrawal function to send balances to addresses that were already approved on those accounts.

• About $108 million in USDC moved out on November 1 and 2.
• Roughly $102 million of that came from Kraken accounts.
• About $5.4 million came from Crypto.com and around $660,000 from OKX.
• Thirteen Kraken withdrawal addresses were used one after another over about six hours on November 1, and two more were used the next day.

Several of those Kraken addresses first received a $1,000 test payment, followed about a minute later by the full balance, usually somewhere between $5 million and $10 million. Test transfers like this are common practice for legitimate treasury teams, which may be one reason the activity didn't stand out sooner.

What Kraken, Crypto.com and OKX are saying

Kraken told Cointelegraph that the incident did not originate on its platform and that it is investigating reports that some of the assets later moved through accounts there. The exchange said it has restricted the accounts in question and is supporting law enforcement with recovery. It also said its security systems were not compromised, no customer accounts were taken over, and there is no ongoing risk to its users.

Crypto.com said it has taken steps to block any funds tied to the incident from moving through its platform, and that its service remains fully operational. OKX also responded to Cointelegraph's questions, and its share of the outflows was small at well under $1 million.

In other words, this does not look like an exchange hack in the usual sense. The open question is who had the authority to use these accounts, and whether the victim's own controls should have caught a string of multimillion-dollar withdrawals on a weekend.

Where the funds went and how much can still be frozen

Once the stablecoins left the exchanges, they were pooled into a small group of wallets within hours. Onchain data provider Bitquery found that about $62.98 million in stablecoins was converted into 27,553 ETH in roughly four hours. ZachXBT said the actor then pushed funds through instant exchange services such as Kyrrex and WellWallet and sent part of it into Monero using Wagyu, a cross-chain swap tool.

Swapping out of USDC and USDT matters because those tokens can be frozen by their issuers, Circle and Tether. Ether and Monero cannot. As of Monday afternoon UTC, Bitquery said about $78.3 million remained in wallets linked to the suspected attacker, but only $3.74 million was still held in USDC that Circle could potentially freeze. Tether had frozen about $1.1 million in USDT.

ZachXBT argued that the lack of a proper incident disclosure allowed more than $30 million to be laundered that EU law enforcement could otherwise have frozen. He also said the laundering pattern does not match the methods normally used by North Korea's Lazarus Group, which the FBI has blamed for the record Binance hack.

Market reaction: ETH and BTC barely move

The theft is large, but it has had little visible effect on prices, as traders stay focused on Binance's recovery, spot ETF outflows and the US midterm elections. At the time of writing, OKX data showed:

• Ethereum (ETH): about $2,288, roughly flat over 24 hours.
• Bitcoin (BTC): about $77,360, down around 0.5%.

You can follow these moves on the Nodora charts page.

What to watch next

The biggest unknown is still the victim. If a bank or regulated financial firm confirms the loss, it would be one of the largest known crypto thefts from a traditional institution, and it would raise hard questions about how such firms manage exchange accounts and approved withdrawal addresses.

Other things to watch:

• Whether Kraken or other exchanges freeze more of the remaining funds, or law enforcement announces seizures.
• Further movement of the roughly 27,500 ETH and how much ends up in Monero, where it becomes very hard to trace.
• Any official statement from EU authorities about the incident or ZachXBT's cover-up claim.

This is the latest in a rough stretch for crypto security, following the Binance breach and the Mercado Bitcoin hack in Brazil. This article is for information only and is not financial advice.

#Ethereum #Kraken #Hack #ZachXBT #Security

This article is general information, not financial advice.