In brief
- An unnamed EU entity is suspected of losing more than $106 million from multiple centralized exchange accounts on Nov. 1, ZachXBT said, with the funds withdrawn as USDC and USDT.
- The thief has since swapped stablecoins for ETH, used instant exchanges, converted funds to Monero and bridged assets across chains.
- ZachXBT said with “a high degree of confidence” that the attacker isn’t North Korea’s Lazarus Group, setting the theft apart from the $6.4 billion Binance hack.
Another nine-figure theft has hit crypto, just days after the biggest heist in the industry’s history.
An unnamed entity in the European Union is suspected of losing more than $106 million from several of its accounts on centralized exchanges on Sunday, pseudonymous onchain investigator ZachXBT said Monday in a post to his Telegram channel.
The funds were withdrawn as USDC and USDT stablecoins by what he called an “illicit actor.”
Open until resolution
In the 24 hours that followed, the actor moved aggressively to cover their tracks, ZachXBT said. The attacker swapped USDC for ETH, sent funds through instant exchange services such as WellWallet and Kyrrex, converted some to the privacy coin Monero via Wagyu and bridged assets across multiple blockchains.
ZachXBT published 11 Ethereum addresses tied to the theft.
Instant exchanges let users quickly swap one cryptocurrency for another, often with little identity verification, while Monero hides senders, receivers and amounts, making it a popular tool for obscuring stolen funds.
Swapping out of USDC and USDT also matters because the companies behind those stablecoins can freeze them.
BitcoinBTC · USD
$76,780−4.14%
Oct 26Oct 28Oct 30Nov 1Nov 2
$81.8k$80.1k$78.4k$76.7k
24h HighHigh$78,728
24h LowLow$76,611
VolVol$980.1M
→Buy Bitcoin with USDC
Powered by Jupiter
ZachXBT said the culprit remains unidentified, but that he could say “with a high degree of confidence” that it isn’t Lazarus Group, citing multiple laundering indicators. Lazarus is the umbrella name often used for North Korea’s state-backed hackers. ZachXBT didn’t name the victim.
That sets the theft apart from the record-setting $6.4 billion Binance hack, which the FBI has attributed to TraderTraitor, a North Korean hacking group.
In that case, stablecoin issuers moved within minutes. Tether froze stolen USDT on Ethereum in 37 minutes, and Circle froze all $823 million in stolen USDC, helping lock up about 44% of the haul, according to blockchain analytics firm Elliptic.
North Korea’s launderers have since spread the remaining funds across about 12,000 wallets. It’s unclear whether any funds in the EU case have been frozen.
The incident adds to an already unprecedented week for crypto security. Beyond the record-breaking Binance hack, Brazilian exchange Mercado Bitcoin just today reported halting withdrawals after a $40 million hack of its own. Likewise today, BTCPay Server told merchants to switch off their servers amid reports of hot wallet attacks.
Join 72,000+ readers
Create an account to save your articles.
Add Decrypt as your preferred source to see more of our stories on Google.
