Blockchain investigator ZachXBT has raised the estimated value of a suspected cryptocurrency theft involving an unidentified European entity to more than $133 million after tracing another $27 million in withdrawals from centralized exchanges.
Summary
- ZachXBT raised the estimated value of a suspected European crypto theft from $106 million to over $133 million after identifying another $27 million in withdrawals from centralized exchanges.
- The blockchain investigator suspects that a major Western European financial institution was compromised and accused the affected organization of concealing the incident.
- ZachXBT claimed that more than $30 million had already been laundered and could potentially have been frozen by European Union law enforcement authorities.
- The suspected attacker reportedly moved funds through Ethereum, instant cryptocurrency exchanges and Monero, while ZachXBT expressed confidence that North Korea’s Lazarus Group was not responsible.
In a November 3 update, ZachXBT said the additional transactions were connected to the same illicit actor identified in his earlier investigation, with some withdrawals taking place after he first disclosed the incident publicly.
The investigator now suspects that a major financial institution in Western Europe may have been compromised and accused the affected organization of concealing the incident.
ZachXBT questions the lack of disclosure after suspected theft
The investigation began with a November 2 community alert, when ZachXBT reported that an unidentified European entity was suspected of losing more than $106 million from several centralized exchange accounts on November 1.
At the time, he identified multiple wallet addresses associated with the withdrawals and published a transaction map showing how the suspected stolen assets had moved between wallets, exchanges and other cryptocurrency services.
The latest update added four more addresses to the investigation, bringing the number of publicly identified theft addresses across both disclosures to 15.
The investigator was particularly critical of the absence of an incident disclosure, claiming that more than $30 million had already been laundered and could potentially have been frozen by European Union law enforcement authorities.
How were the suspected $133 million in stolen funds moved?
According to ZachXBT’s original findings, the attacker initially withdrew the suspected stolen assets in two dollar-pegged stablecoins, USD Coin (USDC) and Tether (USDT), before beginning a series of transactions intended to move the funds through different services.
Over the following 24 hours, the wallets were used to swap USDC for Ethereum (ETH), with portions of the assets subsequently transferred to instant cryptocurrency exchanges, including WellWallet and Kyrrex.
The investigator identified another route involving Wagyu, where funds were converted into the privacy-focused cryptocurrency Monero (XMR).
Other transactions involved bridging assets between blockchain networks, allowing the suspected attacker to move funds through several chains instead of keeping them on a single network.
ZachXBT said he was highly confident that the attacker was not North Korea’s Lazarus Group, citing several indicators from the laundering transactions that differed from patterns he associated with the hacking organization.
In a subsequent post on X, ZachXBT said the suspected attacker was French-speaking and had some on-chain connections to users of cybercrime forums.
Previous investigations have traced stolen funds through Monero
The use of Monero and instant exchanges resembles transaction routes documented in other cryptocurrency theft investigations, where attackers have exchanged stolen assets before moving them to new wallets.
In June, crypto.news previously reported that Tether froze $72 million in USDT after ZachXBT traced approximately $120.2 million through cryptocurrency services and transactions linked to Monero purchases.
The investigation identified movements through Tron, KuCoin, instant exchanges and NEAR Intents wallets before Tether blacklisted an address holding approximately 72.03 million USDT.
More recently, an October 20 investigation linked FreedomXMR inflows on Hyperliquid Core to suspected illicit activity.
ZachXBT estimated that more than 87% of the service’s incoming funds were associated with illicit sources, tracing over $20 million to ransomware payments, cryptocurrency exploits, malware and social engineering attacks.
The identified transactions included funds associated with security incidents involving DCENT Wallet, Fetch.ai, Axelar and online gambling platform Gamdom.
Separately, an October investigation into the Bybit laundering network described how ZachXBT infiltrated an alleged Chinese criminal operation that he claimed had processed more than $1 billion connected to North Korean hackers.
During that investigation, he said he spent $349,700 posing as a customer to obtain transaction information and trace funds associated with the February 2025 Bybit hack.
The investigator subsequently shared evidence with private-sector researchers and law enforcement officials, while Tether froze 442,000 USDT connected to wallets identified during the operation.
