ZachXBT Traces Suspected $106 Million EU Exchange Theft Through Monero

By Coinvote

Published November 3, 2026 - 07:21 UTC | 5 mins read

Blockchain investigator ZachXBT says an unnamed European Union entity may have lost more than $106 million from exchange accounts on Sunday. The funds were swiftly routed through Ether, instant exchanges and Monero, a path that complicates freezes and recovery.

An unnamed EU entity and more than $106 million in missing funds

On Monday, blockchain investigator ZachXBT reported that an unnamed European Union entity is suspected of losing over $106 million through several centralized exchange accounts. According to Cointelegraph, the activity happened on Sunday. Decrypt reported that ZachXBT posted the finding to his Telegram channel.

The money left the accounts as USDC and USDT. According to Decrypt, ZachXBT described the person who withdrew the funds as acting unlawfully and said their identity remains unknown. CoinDesk stressed in its summary that the victim and the affected exchanges are still unknown.

How the money was moved after the withdrawals

Cointelegraph reported that the suspected attacker swapped USDC for Ether and then used instant exchange services, including WellWallet and Kyrrex. Some of the funds were then converted into Monero through a swap service called Wagyu. Decrypt added that ZachXBT saw the actor move aggressively in the 24 hours after the withdrawals, and that assets were also bridged across several blockchains.

ZachXBT identified 11 wallet addresses tied to the theft. Decrypt described them as Ethereum addresses. The Defiant summarized the investigator's findings in similar terms, noting that the funds were being swapped into ETH and sent through instant exchanges, Monero and cross-chain bridges.

Why stablecoins, instant exchanges and Monero matter here

The route is a familiar one for anyone trying to make stolen funds harder to trace. Decrypt explained that instant exchanges let users swap one asset for another quickly, often with little identity verification. Monero hides senders, receivers and amounts, which makes it a popular tool for obscuring stolen money.

Leaving USDC and USDT quickly also has a practical purpose. The companies behind those stablecoins can freeze them, so every swap into another asset narrows the window in which an issuer can act. Decrypt noted that it is unclear whether any of the funds in this case have been frozen.

The key figures at a glance

The reported numbers are small next to the week's largest incident but still significant by any normal measure.

More than $106 million: the suspected loss from exchange accounts on Sunday, according to ZachXBT.
11: wallet addresses ZachXBT linked to the funds.
$786,000: the amount a wallet tied to the King arbitrage bot on Solana may have lost on Monday, according to Onchain Lens.
$40 million: the hack Decrypt said Brazilian exchange Mercado Bitcoin reported on Monday, along with a halt to withdrawals.

Where the outlets agree and where they differ

All four outlets agree on the core claim: an unidentified EU entity, a loss above $106 million, and laundering through Ether, instant exchanges and Monero. Cointelegraph and Decrypt, the two outlets with fuller reporting here, both say ZachXBT does not believe the Lazarus Group is responsible. Decrypt quotes him saying he could say so "with a high degree of confidence," citing multiple laundering indicators.

The outlets differ on the size of the Binance hack used as a comparison. Cointelegraph put it at $6.3 billion and dated it to Oct. 29, while Decrypt cited $6.4 billion. Both attribute the attack to the North Korean group TraderTraitor, as identified by the FBI. Only Decrypt describes the Ethereum address detail and the freezing response, and CoinDesk and The Defiant add no detail beyond their headlines and summaries.

A crowded week for crypto security

Decrypt contrasted this case with the Binance hack. In that incident, it reported, Tether froze stolen USDT on Ethereum within 37 minutes. Circle froze all $823 million in stolen USDC, which, according to the analytics firm Elliptic, helped lock up about 44% of the haul. North Korean launderers have since spread the remainder across about 12,000 wallets.

Other incidents landed the same day. Decrypt also reported that BTCPay Server advised merchants to shut down their servers while reports of hot wallet attacks circulated. Cointelegraph separately reported that a wallet associated with King, a Solana arbitrage bot, may have lost about $786,000. Onchain Lens told the outlet that rapid transfers through several Solana wallets and a later move to Ethereum via Mayan pointed to a possible wallet compromise. Readers tracking newly launched Solana projects can follow them on the new Solana tokens page, though nothing in the reporting links the King incident to any listed token.

What to watch next

The first open question is who lost the money. Until the entity or the exchanges are named, it is hard to judge how the withdrawals were authorized or whether customer funds were involved. The sources do not say.

The second question is whether stablecoin issuers or exchanges freeze any of the remaining funds. Decrypt's comparison with the Binance case shows how much early freezes can matter. Finally, ZachXBT's attribution is an investigator's assessment, not a finding by law enforcement, so any official statement would be worth tracking. Exchange users can check announcements from their platforms and review which withdrawal protections they have enabled.

Market snapshot

Asset	Price	24h	7d	Market cap
Bitcoin (BTC)	$76,555	-1.9%	-4.2%	$1.54 trillion
Ethereum (ETH)	$2,247	-1.5%	-3.0%	$274.51 billion
Monero (XMR)	$621	+2.4%	+1.3%	$11.70 billion

CoinGecko data as of 2026-11-03 (UTC); DeFi TVL from DefiLlama: Ethereum $43.63 billion, Solana $5.39 billion.

On Coinvote

New Solana Tokens Listed Today: 3,767 projects tracked, 35 new listings in 7 days, 533 community votes today.
Best Solana Meme Coins Today: 2,458 projects tracked, 24 new listings in 7 days, 276 community votes today.
New Ethereum Tokens Listed Today: 2,934 projects tracked, 5 new listings in 7 days, 27 community votes today.
Best Ethereum Meme Coins Today: 260 projects tracked, 2 new listings in 7 days, 25 community votes today.

FAQ

How much was stolen in the suspected EU exchange theft?

According to Decrypt, ZachXBT reported a suspected loss of more than $106 million on Sunday from centralized exchange accounts belonging to an unidentified EU entity. The funds were withdrawn as USDC and USDT. Neither the victim nor the exchanges have been named.

Is the Lazarus Group behind the $106 million theft?

ZachXBT said he was highly confident the Lazarus Group is not responsible, pointing to several laundering indicators. The attacker has not been identified. This differs from the Binance hack, which the FBI attributed to the North Korean group TraderTraitor.

How did the attacker move the stolen funds?

According to Cointelegraph and Decrypt, the attacker swapped USDC for Ether and used instant exchange services such as WellWallet and Kyrrex. Some funds were converted to Monero through Wagyu, and assets were bridged across multiple blockchains.