EU Entity Faces Suspected $106M Crypto Theft as Attacker Moves Funds Across Networks

An unidentified EU-based entity may have lost more than $106 million after an attacker allegedly withdrew funds from multiple centralized cryptocurrency exchanges. On-chain investigator ZachXBT reported the suspected theft on November 2. 

The attacker reportedly moved the stolen assets through several cryptocurrencies and instant exchange services. However, investigators have yet to identify the victim, affected exchanges, or the method used to access the accounts.

Attacker Moves Stolen Funds Through Multiple Services

The suspected attacker withdrew the funds in USDC and USDT before converting portions into Ethereum. Additionally, the actor used instant exchange platforms WellWallet and Kyrrex to move assets between different networks.

ZachXBT also identified Wagyu as a service involved in converting some funds into Monero (XMR). Consequently, tracing those converted assets becomes significantly harder because Monero conceals transaction details.

The investigator identified 11 Ethereum addresses associated with the suspected theft. A transaction diagram also showed substantial movements involving approximately 2.64 million USDC and 2,200 ETH.

Lazarus Group Unlikely Behind Attack

Significantly, ZachXBT expressed strong confidence that North Korea’s Lazarus Group did not conduct the attack. However, he did not disclose the specific evidence supporting that assessment.

The incident follows Binance’s October 29 hot wallet breach, which TRM Labs attributed to North Korean hackers. Besides, no affected exchange or victim has independently confirmed the latest reported losses.

Related: Mercado Bitcoin Halts Withdrawals After Security Breach, $4.5M USDT Frozen