On-chain investigator ZachXBT has raised his estimate of the suspected crypto theft from an unnamed European entity to more than $133 million, and blockchain records show that about $17 million of the newly flagged money left exchange accounts hours after he first went public. Part of what followed is still sitting in USDC that nobody has frozen.
“I’ve identified an additional $27M+ of CEX withdrawals by the illicit actor bringing the total to $133M+ for the incident,” ZachXBT said on his Telegram channel on Tuesday, adding that “a portion of the CEX withdrawals occurred after my initial disclosure.” His first alert on Monday put the loss at $106 million. AltcoinReporter traced that first wave to Kraken, OKX and Crypto.com accounts earlier on Tuesday.
A cover-up claim, without a name
ZachXBT also offered a theory about the victim. “My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up,” he wrote, saying the lack of a proper incident disclosure had let more than $30 million be laundered that EU law enforcement could have frozen. He did not name the institution or publish evidence for the cover-up claim.
On X, he added that the attacker “is not Lazarus Group but French-speaking and has a bit of onchain overlap with cybercrime forum users.” Asked by another user whether the victim was Nexo, he replied: “No a bank.”
No bank, exchange or regulator has confirmed a loss. Crypto.com told Cointelegraph it had “taken appropriate action to block any funds associated with this third-party incident from moving through Crypto.com.” OKX said it was looking into the matter, and Kraken had not responded, the outlet reported.
What the four new addresses show
ZachXBT listed four more theft addresses with his update. AltcoinReporter checked their USDC transfers using Blockscout records. All four were paid by the same wallet that blockchain analytics firm Bitquery identifies as Kraken’s main hot wallet, and together they received about $27.8 million, which lines up with his $27 million figure.
Two of the four were already in Bitquery’s count. One received $5.25 million late on Sunday and had taken small withdrawals from the same wallet since August. The other received $5.34 million on Sunday evening. Bitquery had flagged both as missing from ZachXBT’s original list of 11.
The other two are new to the public record, and their timing backs up his claim. ZachXBT’s first alert went out at 12:28 UTC on Monday. One address, which had received small Kraken payouts since mid-October, then took in about 8.52 million USDC in five transfers between 15:46 and 15:50 UTC. The second, a fresh wallet with no earlier history, received about 8.73 million USDC between 16:28 and 16:31 UTC. That is roughly $17.2 million withdrawn three to four hours after the theft was public. Added to Bitquery’s Ethereum count of $108.8 million, it puts the traced total near $126 million, with the rest of ZachXBT’s figure possibly on other chains.
Freezable money that has not been frozen
Both wallets passed the money on within minutes. Following those transfers, AltcoinReporter found two downstream wallets still holding USDC on Tuesday. One held about 1.87 million USDC and the other about 1.78 million at Ethereum block 26,334,159, around midday UTC. A check of the USDC contract showed neither address on Circle’s blacklist.
That $3.65 million is the kind of balance Circle can lock. Bitquery separately said Circle had frozen none of the 2.82 million USDC it tracked in the thief’s wallets, while Tether froze $1.1 million in USDT late on Monday. The money is also still moving. The second downstream wallet sent out another 1.78 million USDC just before noon UTC on Tuesday, and a third wallet that received $6.8 million from the new addresses spent Tuesday morning sending batches of 90,000 to 170,000 USDC to a single address.
Bitquery counted $71.33 million still on Ethereum in addresses tied to the thief as of Tuesday morning, mostly in ETH, which cannot be frozen. The case follows the much larger Binance hot wallet drain, which the FBI pinned on North Korea’s TraderTraitor. In that case, Tether and Circle froze more than $2 billion within hours, according to Bitquery.
FAQ
How big is the suspected EU crypto theft now?
ZachXBT puts it at more than $133 million, up from $106 million, after finding another $27 million in exchange withdrawals. No victim has confirmed the figure.
Did withdrawals continue after the theft was made public?
Yes. On-chain data shows about $17.2 million in USDC reached two of the newly listed addresses three to four hours after ZachXBT’s first alert on Monday.
Can any of the funds still be frozen?
Some. Two wallets downstream of the new addresses held about $3.65 million in USDC on Tuesday and were not blacklisted by Circle, though most of the stolen money is now in ETH.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
