From Decrypt · By Decrypt Staff
In brief
An unnamed EU entity is suspected of losing more than $106 million from multiple centralized exchange accounts on Nov. 1, ZachXBT said, with the funds withdrawn as USDC and USDT.
The thief has since swapped stablecoins for ETH, used instant exchanges, converted funds to Monero and bridged assets across chains.
ZachXBT said with “a high degree of confidence” that the attacker isn’t North Korea’s Lazarus Group, setting the theft apart from the $6.4 billion Binance hack.
Another nine-figure theft has hit crypto, just days after the biggest heist in the industry’s history.
An unnamed entity in the European Union is suspected of losing more than $106 million from several of its accounts on centralized exchanges on Sunday, pseudonymous onchain investigator ZachXBT said Monday in a post to his Telegram channel.
The funds were withdrawn as USDC and USDT stablecoins by what he called an “illicit actor.”
PredictCryptoSOL next move: Pump to $160 or Dump to $40?
46%54%$160$40$22.26K volumeOpen until resolutionOpen until resolutionIn the 24 hours that followed, the actor moved aggressively to cover their tracks, ZachXBT said. The attacker swapped USDC for ETH, sent funds through instant exchange services such as WellWallet and Kyrrex, converted some to the privacy coin Monero via Wagyu and bridged assets across multiple blockchains.
ZachXBT published 11 Ethereum addresses tied to the theft.
Instant exchanges let users quickly swap one cryptocurrency for another, often with little identity verification, while Monero hides senders, receivers and amounts, making it a popular tool for obscuring stolen funds.
Swapping out of USDC and USDT also matters because the companies behind those stablecoins can freeze them.
BitcoinBTC · USD$76,806−4.1%Oct 26Oct 28Oct 30Nov 1Nov 2$81.8k$80.1k$78.4k$76.7k24h HighHigh$78,72824h LowLow$76,611VolVol$978.4M→Buy Bitcoin with USDCPowered by JupiterPrice data by CoinGeckoCoinGeckoMore Bitcoin news and projections →ZachXBT said the culprit remains unidentified, but that he could say “with a high degree of confidence” that it isn’t Lazarus Group, citing multiple laundering indicators. Lazarus is the umbrella name often used for North Korea’s state-backed hackers. ZachXBT didn’t name the victim.
That sets the theft apart from the record-setting $6.4 billion Binance hack, which the FBI has attributed to TraderTraitor, a North Korean hacking group.
In that case, stablecoin issuers moved within minutes. Tether froze stolen USDT on Ethereum in 37 minutes, and Circle froze all $823 million in stolen USDC, helping lock up about 44% of the haul, according to blockchain analytics firm Elliptic.
North Korea’s launderers have since spread the remaining funds across about 12,000 wallets. It’s unclear whether any funds in the EU case have been frozen.