ZachXBT Flags Suspected $106 Million Theft From European Entity Across Centralized Exchanges

An unidentified attacker allegedly stole more than $106 million from a European entity's centralized exchange accounts on Nov. 1, according to findings published by onchain investigator ZachXBT ¹. The researcher stated on Nov. 2 that the attacker withdrew the capital in $USDC and $USDT from accounts across several centralized exchanges ¹. Based on laundering patterns, ZachXBT noted he holds a high degree of confidence that North Korea's Lazarus Group is not responsible for the intrusion ¹.

Tracing data published by ZachXBT, Specter, and blockchain analytics firm TRM Labs showed the perpetrator rapidly traded stablecoins into $ETH over a 24-hour window ¹. The stolen funds were subsequently routed through instant swap platforms, including Kyrrex and WellWallet, while other allocations were bridged to Tron-format addresses ¹. A transaction flow graph revealed that approximately 2.64 million USDC flowed toward Wagyu to swap into $XMR, while 2,200 ETH moved across chain bridges ¹.

Laundering Obfuscation

The pivot into privacy-preserving assets complicates asset recovery, echoing research showing that hackers hold hundreds of millions in crypto beyond freezing reach once transferred out of centralized ecosystems. Because Monero conceals transaction parties and values by default, forensic tracking relies heavily on remaining balances across 11 flagged Ethereum addresses and interactions with centralized swap venues ¹. At the time of writing, $BTC traded at $77,382 while XMR traded at $601.51.

Neither the targeted European organization nor the affected exchanges have publicly confirmed the security breach or disclosed the initial access vector ¹. The incident follows separate high-profile platform compromises, including an attack on Binance where the FBI blamed North Korea for a multi-billion exploit in late October ¹.