
Blockchain investigator says additional $27 million withdrawn from centralized exchanges as victim identity remains unverified.
Blockchain investigator ZachXBT increased his estimate of a suspected crypto theft targeting an unidentified European Union entity to over $133 million, citing additional withdrawals from centralized exchanges.
AI-generated summary
Investigator ZachXBT tracked unauthorized withdrawals and token conversions from an unidentified European Union entity.
Blockchain investigator ZachXBT has raised his estimate of a suspected crypto theft from an unidentified European Union entity to more than $133 million.
On Tuesday, ZachXBT said he identified another $27 million in withdrawals from centralized exchanges, increasing the suspected losses from the $106 million he initially reported on Monday. He said some withdrawals occurred after his primary disclosure.
“My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up,” ZachXBT said Tuesday on his Telegram channel.
He also said that the lack of a proper incident disclosure allowed more than $30 million to be laundered, claiming EU law enforcement could otherwise have frozen the funds. The victim’s identity and allegations of a cover-up remain unverified.
Bitquery reported that $62.98 million in stablecoins was converted into 27,553 Ether (ETH) within roughly four hours. As of 13:47 UTC Monday, approximately $78.3 million remained in wallets linked to the suspected attacker, while $30.5 million had moved out of the tracked addresses.
Only $3.74 million remained in USDC that issuer Circle could potentially freeze, according to Bitquery.
ZachXBT said earlier that the attacker was swapping funds into ETH and Monero (XMR) through instant exchanges and cross-chain bridges. He added that the laundering patterns did not match those typically used by North Korea’s Lazarus Group.

Rival crypto exchanges including Bybit, Bitget, and OKX saw a surge in deposit activity and inflows following Binance's Oct. 29 hack and subsequent withdrawal suspension.

North Korea denies involvement in a massive Binance hack, calling U.S. accusations a political provocation. Meanwhile, Binance reports $4.72 billion in net withdrawals following the $6 billion theft.

BTCPay Server urges merchants to rebuild outdated payment servers and replace wallets following attacks that stole $1.63 million in Bitcoin and Litecoin.

Cathie Wood’s ARK Invest purchased millions of dollars worth of Coinbase and Circle shares on Friday and Monday amid declining crypto stocks, while reducing its stake in Bullish.

IMF economist Marco Reuter's research indicates that dollar stablecoin activity remains elevated even after capital controls end, aligning with BIS findings on durable dollar access.

Binance plans to resume cryptocurrency withdrawals for additional assets progressively from 04:00 UTC on Tuesday, following an initial reopening on Nov. 1. Withdrawal volumes have stabilized after last week's $6.3 billion hack, with Monday net outflows at $2.57 billion compared to $6.1 billion on Sunday. Fiat withdrawals for several currencies have also reopened.