Suspected $106M EU Entity Theft Across Multiple Exchanges

An unidentified EU entity suffered a $106+ million crypto theft from multiple centralized exchange accounts on November 1, 2026, according to on-chain investigator ZachXBT's alert published on November 2. The attacker withdrew funds primarily as USDC and USDT from the exchange accounts. ZachXBT's analysis shows roughly $80 million in USDC arriving at 11 different wallet addresses over an 11-hour period. Particularly concerning was the speed of fund movement, $9.6 million was transferred from five of these wallets within just three minutes of initial receipt. The stolen assets followed a complex laundering pattern. After initial withdrawal, the attacker converted USDC to ETH, purchasing 27,553 ETH worth approximately $62.97 million at an average price of $2,286 per token. This strategic move from stablecoins to ETH was significant because, unlike USDC and USDT which can be frozen by their issuers Circle and Tether respectively, ETH lacks a central issuer that can block transfers. ZachXBT traced the funds' subsequent movement through instant-exchange services including WellWallet and Kyrrex. Some of the ETH was further converted to Monero (XMR) using the Wagyu privacy tool, adding another layer of obfuscation to the fund flows. The 11 wallet addresses published by ZachXBT represent different stages of this money laundering operation. The victim entity and the specific exchanges involved have not been publicly identified. Neither the EU entity nor any of the exchanges have confirmed the theft. ZachXBT did not disclose how the attacker gained access to the exchange accounts, and the exact compromise vector remains unknown. The suspected theft comes amid heightened security concerns in the crypto sector. It follows the FBI's confirmation that North Korea's Lazarus Group was responsible for the $6.4 billion Binance hack, as well as the $40 million Mercado Bitcoin breach in Brazil. These incidents collectively demonstrate the increasing sophistication of crypto theft operations targeting institutional holdings. The incident highlights the vulnerability of centralized exchange accounts, particularly when holding large sums of institutional capital. The rapid conversion from stablecoins to harder-to-trace assets like ETH and Monero within minutes of receipt suggests well-coordinated laundering operations.

Key Vulnerability: Centralized Exchange Account Takeover

The attack appears to have targeted the exchange accounts directly rather than exploiting smart contract vulnerabilities. This method suggests either credential compromise or API key theft from the institutional trading infrastructure. The scale of the theft, over $106 million, indicates the victim likely held substantial trading capital across multiple exchange platforms.

Sector-Wide Security Implications

This incident shows the growing trend of high-value crypto thefts targeting institutional holdings rather than retail users. The sophisticated laundering techniques employed, including rapid conversion through multiple privacy tools and instant-exchange services, represent an evolution in crypto theft methodologies compared to earlier, more straightforward attacks. The lack of public confirmation from either the victim or affected exchanges reflects ongoing challenges in incident disclosure and coordination within the crypto security community. While ZachXBT's analysis provides detailed on-chain evidence, the absence of independent verification means the full scope of the operation remains uncertain.