A suspected $106 million crypto theft from exchange accounts belonging to an unnamed European company has been traced to withdrawals from Kraken, OKX and Crypto.com, and most of the stolen stablecoins have already been turned into ETH. Part of the money that was still freezable on Monday has since moved too, AltcoinReporter’s own check of the blockchain shows.
On-chain investigator ZachXBT first flagged the case on Monday. “An EU entity is suspected of losing $106M+ from multiple centralized exchange accounts yesterday (Nov 1),” ZachXBT said on his Telegram channel. He said the funds were withdrawn as USDC and USDT, and that the thief was swapping USDC for ETH and moving funds through instant exchange services, including WellWallet and Kyrrex, into Monero via Wagyu, and across bridges. He also said he could state “with a high degree of confidence” that the attacker was not North Korea’s Lazarus Group, based on multiple laundering indicators. He published 11 addresses tied to the theft.
What the trace shows
Blockchain data firm Bitquery followed the money further in a trace published Monday. It counted $108.80 million in USDC leaving the main hot wallets of Kraken, Crypto.com and OKX for 15 wallets over about 21 hours. The first withdrawal came from OKX at 12:25 UTC on Sunday. Kraken followed 44 minutes later and ended up paying out about 95% of the total across 178 withdrawals.
The pace is the striking part. Bitquery said $73.2 million left in the three hours before 23:00 UTC on Sunday, and 98% of the money was out by 23:10 UTC. One wallet received 43 separate Kraken withdrawals in 91 minutes, each below $50,000.
Eleven of the 15 receiving wallets had been paid by the same exchanges before, one of them since May, and those wallets took 84% of the funds. Bitquery said nothing in the data shows Kraken itself was hacked, and that the pattern fits a break-in on the customer side. The victim has not been named. Bitquery found four receiving wallets that were not on ZachXBT’s list, which together took $28 million.
From there, the thief moved quickly. About $62.98 million in stablecoins was swapped into 27,553 ETH through UniswapX in roughly four hours. As of Bitquery’s snapshot at 13:47 UTC on Monday, about $78.27 million was still sitting on Ethereum, while around $30.5 million had already left. That included $8.12 million sent to a KuCoin deposit address that Bitquery said likely belongs to Kyrrex, $4.34 million through LI.FI, $1.32 million to FixedFloat and about $7.10 million net through six bridges.
The freezable money is shrinking
USDC can be frozen by its issuer, Circle, while ETH cannot. Bitquery counted only $3.74 million still held as USDC at its snapshot, including one wallet, 0x25bb…cdb5, holding 1.53 million USDC.
That wallet has since emptied its USDC. Blockscout records and Ethereum node data reviewed by AltcoinReporter show it swapped the full 1.53 million USDC for ETH in five transactions between about 16:54 and 18:42 UTC on Monday, a few hours after Bitquery’s snapshot. When AltcoinReporter checked on Tuesday, the wallet held about 672.7 ETH and no USDC. It had also received a fake token labelled “ETH,” a common address-poisoning trick that does not affect the real balance.
That means at least 1.53 million of the 3.74 million USDC that could have been frozen on Monday is now out of reach of a stablecoin freeze. The 11 addresses ZachXBT published now hold only small amounts of USDC, the largest about 643 USDC.
What is still unknown
No exchange or victim had commented publicly as of Tuesday. CoinDesk reported that it could not independently confirm the losses. Bitquery’s figures also come with caveats. Its total would be $95.71 million without two wallets it linked to the theft only indirectly, and it looked at Ethereum alone, so any USDT or other chain activity is not in its numbers.
How the attacker got into the accounts is the main open question. ZachXBT ruled out Lazarus but did not name a suspect. Eight of the 15 receiving wallets are Trust Wallet smart accounts, though Bitquery said nothing points to a flaw in the wallet app.
The case lands in a heavy stretch for exchange-related losses. AltcoinReporter has covered Mercado Bitcoin’s withdrawal halt and the FBI’s attribution of the Binance hack to North Korea. This one differs in a key way: most of the money went to wallets the same exchanges had paid before, which is why Bitquery points to a break-in on the customer side rather than at an exchange.
FAQ
Which exchanges were involved in the suspected $106 million theft?
Bitquery traced the withdrawals to the main hot wallets of Kraken, OKX and Crypto.com. Kraken accounted for about 95% of the USDC. Bitquery said nothing shows the exchanges themselves were hacked.
Who was behind the theft?
No one has been identified. ZachXBT said he was highly confident it was not Lazarus Group, based on how the funds were laundered.
Can the stolen funds still be frozen?
Only a small part. Most of the USDC was swapped into ETH, which issuers cannot freeze, and a 1.53 million USDC balance flagged on Monday was converted to ETH later that day.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
