An unidentified corporate entity or investment fund in the European Union (EU) may have had more than $106 million in cryptocurrency assets stolen from custodial accounts across multiple centralized exchanges on November 1, according to on-chain investigation findings from independent security researcher ZachXBT.
The incident adds to a string of severe security breaches over the past week, following the $40 million attack on the Mercado Bitcoin exchange, and reflects a trend of illicit funds seeking anonymity channels similar to fund transfers into transaction mixers.
Laundering route via Ethereum, instant exchanges, and Monero
According to ZachXBT’s analysis, the attacker gained access and completely drained the victim’s balances held in two USD-pegged stablecoins, USDC and USDT. To avoid the risk of issuers like Tether or Circle intervening by freezing on-chain smart contracts, the perpetrator quickly swapped all the USDC for Ether (ETH) within the following 24 hours.
Next, the funds were dispersed across instant exchange platforms such as WellWallet and Kyrrez, before a portion was converted into the privacy coin Monero (XMR) via the Wagyu service.
Monero’s technological features completely obscure sending addresses, receiving addresses, and transaction amounts, making it virtually impossible for traditional blockchain tracking tools to trace the subsequent path of the funds once converted.
No signs of North Korean hacking group
ZachXBT published a list of 11 wallet addresses directly tied to this suspicious withdrawal. However, the specific identity of the victim organization and the exchanges where accounts were compromised have not been officially disclosed, and the involved parties have yet to confirm the extent of the losses.
Notably, the investigator stated with high confidence that this incident was not carried out by North Korea’s Lazarus Group, based on technical indicators and laundering procedures that diverge from the group’s usual patterns.
The incident sounds yet another alarm over the security risks facing institutional accounts on centralized exchanges, where attackers may have compromised API credentials or breached the victim’s internal devices.