ZachXBT flags $106 million suspected stolen from EU entity

The wallet that looked like a whale loading up on ETH overnight turned out to belong to a thief. That is the conclusion of onchain investigator ZachXBT, who on November 2 flagged a suspected theft of more than $106 million from the accounts of a European Union entity at several centralized exchanges. The funds were withdrawn on November 1 as USDC and USDT. As of the alert, no victim or exchange had publicly confirmed a loss, the actor remained unidentified, and how the accounts were accessed was still unknown. So the $106 million stays a suspicion, not a confirmed loss.

From stablecoins to ETH, then to Monero

The rush had a reason: USDC and USDT can be frozen by their issuers, ETH cannot. In the 24 hours before the alert, the actor aggressively swapped stablecoins into ETH. One wallet, 0x9EcA, spent about $62.97 million buying 27,553 ETH at an average price of $2,286. Lookonchain had flagged that wallet at 01:17 UTC as whales buying ETH heavily. From there the money moved through instant exchanges such as WellWallet and Kyrrex, part of it was converted to Monero through the swap service Wagyu, and part was bridged to other chains, including Tron. ZachXBT published 11 Ethereum addresses he tied to the theft, along with a flow graph produced with Specter and TRM Labs.

A second count gives a slightly different figure, and that is expected because the method differs. Bitquery, tracing the main wallets of three exchanges on Ethereum, counted $108.8 million in USDC leaving for 15 receiving addresses, with Kraken as the largest source, followed by OKX and Crypto.com. Bitquery also found only $3.7 million left in freezable USDC, and about $78.27 million still sitting at Ethereum addresses tied to the actor as of 13:47 UTC on November 2. These figures trace the same trail from a different angle, not two thefts to be added together.

Not Lazarus, according to ZachXBT

One of ZachXBT's assertions matters because of the context. In the same week, the FBI blamed the North Korea-linked TraderTraitor group for the $6.3 billion Binance hack, and Pyongyang denied the charge on November 2. For this EU case, ZachXBT said the opposite: with a high degree of confidence, the culprit is not the Lazarus Group, based on several laundering indicators he did not spell out. The EU entity itself could be a company, a trading firm, or an investment fund, and there is no public evidence of a wider breach affecting ordinary EU customers. What can still be followed now is the remaining trail: balances at public Ethereum addresses and hops through named services such as Kyrrex and Wagyu. Once funds become Monero, which hides sender, receiver, and amount by default, the trail effectively ends. The Mercado Bitcoin incident, whose figures are also still estimates, is in our Chainalysis article. Binance's reserves proof, which users can now verify themselves, is in our zk-proof article.

Sources: Unchained (Nov 2, 2026), BeInCrypto (Nov 2, 2026), Bitquery via Coindoo (Nov 2, 2026), TradingView/99Bitcoins (Nov 2, 2026). Figures are snapshots at writing time, midday November 3, 2026 WIB, and can change.

Written by Mastechon

Writing about crypto and Super Intelligence: market news, new projects, Super Intelligence models, and early opportunities like airdrops and testnets. Every piece starts from the official announcement, with the costs worked out up front.