ZachXBT Flags Suspected $106 Million-Plus Theft From EU Entity
- Published
- Updated
- Since then
- 34 new reports
ZachXBT first flagged a suspected theft from an unidentified EU entity, then later tied the alleged losses to French bank Crédit Mutuel Arkéa. The case moved from an initial estimate above $106 million to more than $133 million after additional exchange withdrawals were traced, while Kraken said it restricted related accounts and that its own systems were not compromised.
Key claims & sources
What it means
ZachXBT built his reputation tracing North Korea's Lazarus Group through hacks like the 2022 Ronin Bridge theft and this year's Bybit breach, so his explicit statement that Lazarus is not behind this one carries weight. Centralized exchanges have long promised custodial safeguards after years of hacks, yet this case again shows funds leaving 'multiple exchange accounts' within minutes, repeating a pattern regulators and security firms have tried to close since FTX's 2022 collapse exposed weak internal controls.
The unnamed EU entity now faces the task of proving to its exchanges, auditors and possibly regulators exactly how its accounts were compromised, while those exchanges must explain how withdrawals worth over $106 million cleared without triggering holds. Compliance teams at platforms touched by the laundering trail, from instant-exchange services to bridge operators, will face requests to freeze or flag wallets. Forensic firms and investigators like ZachXBT gain relevance as the de facto first responders in such cases.
Routing stolen funds through Monero after passing through USDC, USDT and ETH shows the limits of blockchain transparency once privacy coins enter the chain, a point regulators have cited for years in pushing exchanges to delist Monero. The case sharpens a real trade-off: tools built for financial privacy also shield thieves, and no amount of on-chain analytics fully closes that gap once funds cross into opaque rails. Centralized custody, meant to offer safety, remains the entry point for the theft itself. (per cryptobriefing.com)
Whether the EU entity is named, and whether any exchange confirms a breach or compensates losses, will determine if this becomes a regulatory case study or fades as an unresolved mystery. ZachXBT's Telegram alert from November 2 is the only public account so far; a follow-up identifying wallets tied to the Monero exit or naming the victim organization would mark the next concrete development worth tracking.
Market reaction i
Coverage timeline
Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.
Thefts of a similar size
| When | What happened | Figure |
|---|---|---|
| 8 days ago | Binance CEX · Key Leaked via Infrastructure incident | $6.4B |
| 8 days ago | Binance · DevOps Engineer’s laptop compromised incident | $6.3B |
| 5.9 years ago | LuBian · Weak key generation incident | $3.5B |
| 5.5 years ago | Thodex · Scam incident | $2.5B |
| 5.4 years ago | Africrypt · Scam incident | $2.3B |
4280 incidents stored · 0 were as large as this one or larger ($235B)