Suspected $133M Crypto Theft From an EU Entity Flows Into ETH and Monero

A European entity whose name has not been disclosed may have lost more than $133 million from accounts at centralized exchanges. On Monday, blockchain investigator ZachXBT spoke of $106 million, and on Tuesday added another $27 million in withdrawals, some of which happened after the first post.

The theft took place on Sunday, November 1, a few days after the record $6.3 billion hack at Binance. But the pattern is different. ZachXBT's assessment is that the funds were not moved by North Korea's Lazarus Group.

From $106 million to $133 million in a day

The timeline is short. On Sunday, more than $106 million left several accounts of one European company at exchanges as USDC and USDT. On Monday ZachXBT published a first post on Telegram. On Tuesday the estimate rose to $133 million, because another $27 million of withdrawals turned up.

"My working theory is a large financial institution in Western Europe was exploited and it's currently being covered up."

ZachXBT, blockchain investigator, from a Telegram post on November 3, 2026

That is a theory, not an established fact. Neither the victim nor the exchanges have been named publicly, and nobody has confirmed the claim of a cover-up. Still, ZachXBT argues that the lack of an official disclosure let more than $30 million be laundered, funds that EU law enforcement could otherwise have frozen.

How the money moved through laundering

The attacker pulled out stablecoins and then moved fast. First the USDC was swapped for Ethereum, then the funds went through the instant exchange services WellWallet and Kyrrex. Some was converted to Monero via Wagyu and bridged across several blockchains. Such services often barely check who the customer is, and Monero hides the sender, the receiver and the amount.

The speed was calculated by analytics firm Bitquery. Division gives an average price near $2,290 per ETH. Within four hours the money had left stablecoins, which an issuer can block with a single decision.

On Monday, $78.3 million still sat in wallets

As of 13:47 UTC on Monday, linked wallets held about $78.3 million, and another $30.5 million had already left the tracked addresses. Only $3.74 million in USDC could be frozen through Circle, roughly 3.5% of the original $106 million. The rest became ETH and other assets that a stablecoin issuer cannot block.

How this differs from the Binance hack

The gap shows in freezing speed. After the Binance hack, Tether blocked the stolen USDT on Ethereum in 37 minutes, and Circle froze all of the stolen USDC, $823 million. According to Elliptic, that helped lock up about 44% of the haul. In the EU case it is unknown whether anything has been frozen at all.

By ZachXBT's logic, the victim's silence bought time for laundering. North Korean launderers have already spread the rest of the Binance loot across about 12,000 wallets. The scale here is smaller but the signature is different, which is why Lazarus is ruled out with a high degree of confidence.

A week that stress-tests exchanges

This is not the only incident of these days. Brazil's Mercado Bitcoin halted withdrawals after losing about $40 million, and BTCPay Server urged merchants to switch off their servers over hot wallet attacks. Cointelegraph also reported a possible $786,000 drain from the wallet of King, an arbitrage bot on Solana.

• Whether the victim and the exchanges the money left from will be named.
• Freezes. Whether any part of the remainder can be blocked before it passes through new swaps.
• Whether the loss estimate gets raised a third time, since ZachXBT has already done it once.

Bottom line for Tuesday

At least $133 million, of which more than $30 million is already laundered, according to ZachXBT. The $3.74 million that can still be frozen in USDC is only 2.8% of that sum. The cautious forecast is simple. The longer there is no public disclosure, the smaller the share of funds that can still be recovered.