Investigator flags suspected $106M theft from an unnamed EU entity's exchange accounts

An unidentified entity in the European Union may have lost more than $106 million in crypto drained from accounts held at multiple exchanges on Sunday, according to blockchain investigator ZachXBT, whose findings CoinDesk reported on Nov. 2. The losses have not been independently confirmed, and none of the parties involved has said anything publicly.

In a Telegram alert on Monday, ZachXBT said the suspected attacker first withdrew the dollar-pegged stablecoins USDC and USDT. Over the following 24 hours, per his account, the funds were swapped from USDC into ether, pushed through instant-exchange services including WellWallet and Kyrrez, and partly converted into the privacy coin Monero using a service called Wagyu. That routing matters: issuers can freeze USDC and USDT, but neither ether nor Monero can be frozen by a central party, and Monero obscures transaction details, making the trail harder to follow.

ZachXBT published 11 wallet addresses he linked to the suspected theft. He did not name the victim or the affected exchanges, and did not say how the attacker got into the accounts. He did rule out one suspect, writing that he could say "with a high degree of confidence" the culprit was not North Korea's Lazarus Group, "based on multiple laundering indicators."

The word "entity," ZachXBT noted, could mean a company, trading firm or investment fund; he didn't specify which.

Key facts

• Reported loss: more than $106 million, from accounts at multiple exchanges, drained Sunday (ZachXBT, via CoinDesk).
• Laundering path: USDC/USDT → ether → instant exchanges WellWallet and Kyrrez → Monero via Wagyu (ZachXBT).
• 11 wallet addresses published; victim, exchanges and access method unidentified (ZachXBT).
• Lazarus Group ruled out "with a high degree of confidence" (ZachXBT).
• No public confirmation from the EU entity or any exchange (CoinDesk).

The real-world read

Treat the $106 million as a single investigator's reading of on-chain activity, not an established fact. ZachXBT has a strong track record, but CoinDesk is explicit that the losses "have not been independently confirmed," and no victim or exchange has acknowledged anything. The sourcing is one Telegram post; everything downstream rests on it.

What's conspicuously missing is the "how" — no access vector, no named victim, no named exchanges. That leaves the central question (was this a hack, insider theft, or compromised credentials?) open. The context, however, is real: CoinDesk notes the alert lands days after roughly $6.4 billion was stolen from Binance — attributed by the FBI to North Korea's TraderTraitor group — and amid a reported ~$40 million drain at Brazil's Mercado Bitcoin. Ruling Lazarus out here is notable precisely because the backdrop is a wave of DPRK-linked thefts.

Opinion, and whose

ZachXBT: high confidence this was not Lazarus Group, based on laundering patterns. That is his analytical judgment, not a confirmed attribution — and no one has confirmed the theft itself.

Sources

• CoinDesk (Nov. 2, 2026) — reported ZachXBT's findings, the laundering path, the published addresses, the Lazarus exclusion, and the lack of independent confirmation; also supplied surrounding context on the Binance and Mercado Bitcoin incidents.
• ZachXBT (primary) — the investigator's Monday Telegram alert, as relayed by CoinDesk; the original source of the $106M figure, the wallet list and the transaction trail.

Not financial advice. Details here are unconfirmed and may change as more is known.