ZachXBT flags $106M theft from EU entity's exchange accounts

November 2, 2026

Blockchain investigator ZachXBT reported on Nov. 2 that an unidentified EU entity may have lost more than $106 million from accounts at multiple crypto exchanges on Sunday, per a Telegram alert. The suspected attacker withdrew funds in USDC and USDT, then moved them through ether, instant-exchange services including WellWallet and Kyrrez, and converted some into Monero via Wagyu — an asset that obscures transaction details and can't be frozen by a central issuer.

ZachXBT published 11 wallet addresses tied to the suspected theft but did not name the victim, the affected exchanges, or how the accounts were accessed; the losses have not been independently confirmed.
He said he is "highly confident" the attacker is not Lazarus Group based on laundering indicators.
The report lands days after the record $6.4 billion Binance hack and alongside other suspected exchange thefts, though neither the EU entity nor any exchange has publicly confirmed this incident.

ZachXBT published 11 wallet addresses tied to the suspected theft but did not name the victim, the affected exchanges, or how the accounts were accessed; the losses have not been independently confirmed.
He said he is "highly confident" the attacker is not Lazarus Group based on laundering indicators.
The report lands days after the record $6.4 billion Binance hack and alongside other suspected exchange thefts, though neither the EU entity nor any exchange has publicly confirmed this incident.

ZachXBT flags $106M theft from EU entity's exchange accounts

Sources

ZachXBT flags $106M theft from EU entity's exchange accounts

Sources