ZachXBT alleges cover-up as suspected crypto theft tops $133M

Blockchain investigator ZachXBT has raised the estimated value of a suspected cryptocurrency theft involving an unidentified European entity to more than $133 million after tracing another $27 million in withdrawals from centralized exchanges.

Summary

• ZachXBT raised the estimated value of a suspected European crypto theft from $106 million to over $133 million after identifying another $27 million in withdrawals from centralized exchanges.
• The blockchain investigator suspects that a major Western European financial institution was compromised and accused the affected organization of concealing the incident.
• ZachXBT claimed that more than $30 million had already been laundered and could potentially have been frozen by European Union law enforcement authorities.
• The suspected attacker reportedly moved funds through Ethereum, instant cryptocurrency exchanges and Monero, while ZachXBT expressed confidence that North Korea's Lazarus Group was not responsible.

In a November 3 update, ZachXBT said the additional transactions were connected to the same illicit actor identified in his earlier investigation, with some withdrawals taking place after he first disclosed the incident publicly.

The investigator now suspects that a major financial institution in Western Europe may have been compromised and accused the affected organization of concealing the incident.

ZachXBT questions the lack of disclosure after suspected theft

The investigation began with a November 2 community alert, when ZachXBT reported that an unidentified European entity was suspected of losing more than $106 million from several centralized exchange accounts on November 1.

At the time, he identified multiple wallet addresses associated with the withdrawals and published a transaction map showing how the suspected stolen assets had moved between wallets, exchanges and other cryptocurrency services.

The latest update added four more addresses to the investigation, bringing the number of publicly identified theft addresses across both disclosures to 15.

The investigator was particularly critical of the absence of an incident disclosure, claiming that more than $30 million had already been laundered and could potentially have been frozen by European Union law enforcement authorities.

How were the suspected $133 million in stolen funds moved?

According to ZachXBT's original findings, the attacker initially withdrew the suspected stolen assets in two dollar-pegged stablecoins, USD Coin (USDC) and Tether (USDT), before beginning a series of transactions intended to move the funds through different services.

Over the following 24 hours, the wallets were used to swap USDC for Ethereum (ETH), with portions of the assets subsequently transferred to instant cryptocurrency exchanges, including WellWallet and Kyrrex.

The investigator identified another route involving Wagyu, where funds were converted into the privacy-focused cryptocurrency Monero (XMR).

Other transactions involved bridging assets between blockchain networks, allowing the suspected attacker to move funds through several chains instead of keeping them on a single network.

ZachXBT said he was highly confident that the attacker was not North Korea's Lazarus Group, citing several indicators from the laundering transactions that differed from patterns he associated with the hacking organization.

In a subsequent post on X, ZachXBT said the suspected attacker was French-speaking and had some on-chain connections to users of cybercrime forums.

Previous investigations have traced stolen funds through Monero

The use of Monero and instant exchanges resembles transaction routes documented in other cryptocurrency theft investigations, where attackers have exchanged stolen assets before moving them to new wallets.

In June, crypto.news previously reported that Tether froze $72 million in USDT after ZachXBT traced approximately $120.2 million through cryptocurrency services and transactions linked to Monero purchases.

The investigation identified movements through Tron, KuCoin, instant exchanges and NEAR Intents wallets before Tether blacklisted an address holding approximately 72.03 million USDT.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.