hack or exploit

ZachXBT Flags Suspected $106 Million-Plus Theft From EU Entity

74Importance
no updates 6h+Status
17News media
35Pieces
Published
Updated
Since then
34 new reports
Also mentions
ETHXMRUSDC +3

ZachXBT first flagged a suspected theft from an unidentified EU entity, then later tied the alleged losses to French bank Crédit Mutuel Arkéa. The case moved from an initial estimate above $106 million to more than $133 million after additional exchange withdrawals were traced, while Kraken said it restricted related accounts and that its own systems were not compromised.

Key claims & sources

✓
On Nov. 1, an unidentified EU entity may have lost more than $106 million from accounts at multiple centralized exchanges.
✓
The withdrawn funds were moved out as USDC and USDT, then routed through ETH, instant exchanges, Monero and cross-chain bridges.
✓
ZachXBT later traced another $27 million in exchange withdrawals and lifted the suspected total above $133 million.
✓
Kraken said it restricted accounts linked to the suspected theft and said its own systems and customer accounts were not compromised.
✓
He then named Crédit Mutuel Arkéa as the alleged victim, and the bank had not publicly confirmed the incident at that point.
✓
Crédit Mutuel Arkéa later confirmed it suffered a cyberattack that enabled fraudulent transactions.

What it means

ZachXBT built his reputation tracing North Korea's Lazarus Group through hacks like the 2022 Ronin Bridge theft and this year's Bybit breach, so his explicit statement that Lazarus is not behind this one carries weight. Centralized exchanges have long promised custodial safeguards after years of hacks, yet this case again shows funds leaving 'multiple exchange accounts' within minutes, repeating a pattern regulators and security firms have tried to close since FTX's 2022 collapse exposed weak internal controls.

The unnamed EU entity now faces the task of proving to its exchanges, auditors and possibly regulators exactly how its accounts were compromised, while those exchanges must explain how withdrawals worth over $106 million cleared without triggering holds. Compliance teams at platforms touched by the laundering trail, from instant-exchange services to bridge operators, will face requests to freeze or flag wallets. Forensic firms and investigators like ZachXBT gain relevance as the de facto first responders in such cases.

Routing stolen funds through Monero after passing through USDC, USDT and ETH shows the limits of blockchain transparency once privacy coins enter the chain, a point regulators have cited for years in pushing exchanges to delist Monero. The case sharpens a real trade-off: tools built for financial privacy also shield thieves, and no amount of on-chain analytics fully closes that gap once funds cross into opaque rails. Centralized custody, meant to offer safety, remains the entry point for the theft itself. (per cryptobriefing.com)

Whether the EU entity is named, and whether any exchange confirms a breach or compensates losses, will determine if this becomes a regulatory case study or fades as an unresolved mystery. ZachXBT's Telegram alert from November 2 is the only public account so far; a follow-up identifying wallets tied to the Monero exit or naming the victim organization would mark the next concrete development worth tracking.

Market reaction i

EthereumETH the event is about this asset
first headline
+0.3% 2 h before
-1.1% 4 h after
$2,291price at publication
12data points

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Nov 2 12:38
The Defiant scoop
Breaks the event: $106M
+11 min
Nov 2 12:49
Crypto Briefing context
Its angle: regulatory, impacting, scrutiny
+3 h 7 m
Nov 2 15:45
+3 h 57 m
Nov 2 16:35
Unchained context
Its angle: community, identify, spelling; with quotes
+4 h 18 m
Nov 2 16:56
CP CryptoPotato echo
No new facts: separately, converting, custodial; with quotes
+4 h 43 m
Nov 2 17:21
CoinDesk echo
Picks up what was published, with no new facts
+5 h 52 m
Nov 2 18:30
CR Cryptopolitan echo
No new facts: untraceable, researchers, reconstruct
+6 h 14 m
Nov 2 18:51
Coinpedia echo
No new facts: coinpedia, fintech
+8 h 38 m
Nov 2 21:16
Decrypt echo
No new facts: mystery, sunday; with quotes
+8 h 38 m
Nov 2 21:16
Cointelegraph echo
No new facts: arbitrage, solana, $786k
+19 h 40 m
Nov 3 08:18
Cointelegraph adds
Adds $133M and $27M
+20 h 5 m
Nov 3 08:43
crypto.news echo
No new facts: alleges, tops
+21 h 53 m
Nov 3 10:30
Unchained echo
No new facts: regulator, portion, offered; with quotes
+23 h 18 m
Nov 3 11:55
CR Cryptopolitan echo
No new facts: disclosures, undisclosed, authorities; with quotes
+23 h 46 m
Nov 3 12:24
The Defiant echo
No new facts: enforcement, systems, law; with quotes
+1 d
Nov 3 12:55
Crypto Economy echo
No new facts: stablecoin, unverified, withheld; with quotes
+1 d 1 h
Nov 3 13:44
Crypto News Flash adds
Adds $6.4B
+1 d 2 h
Nov 3 15:20
Bitcoinist echo
No new facts: restricted, questioned, concealed; with quotes
+1 d 3 h
Nov 3 16:00
Crypto Briefing echo
No new facts: recovering, ongoing, block
+1 d 9 h
Nov 3 22:00
AMBCrypto adds
Brings into the story: ETH, XMR
+1 d 9 h
Nov 3 22:30
AMBCrypto echo
No new facts: assisting, efforts, track; with quotes
+1 d 13 h
Nov 4 02:36
Crypto Briefing echo
No new facts: transparency, mitigate, related
+1 d 14 h
Nov 4 03:35
Cointelegraph echo
No new facts: identifies; with quotes
+1 d 16 h
Nov 4 04:57
+1 d 18 h
Nov 4 07:30
BeInCrypto adds
Adds $235B and $30M, with quotes
+1 d 19 h
Nov 4 08:09
CR Cryptopolitan echo
No new facts: processing, suggesting, researcher
+1 d 21 h
Nov 4 10:18
+1 d 21 h
Nov 4 10:19
The Crypto Guardian echo our clock
No new facts: authentication, credentials, $133000000; with quotes
+1 d 22 h
Nov 4 10:45
Unchained echo
No new facts: accounting, spotlight, regulated; with quotes
+1 d 22 h
Nov 4 11:20
+2 d
Nov 4 12:45
The Cryptocurrency Post echo
No new facts: responsible, sequence, obscure; with quotes
+2 d
Nov 4 12:48
CP CryptoPotato echo
No new facts: available, meanwhile, analysis; with quotes
+2 d 3 h
Nov 4 15:40
Crypto Economy echo
No new facts: established, connection, originated; with quotes
+2 d 3 h
Nov 4 16:00
The Crypto Guardian echo
No new facts: confirmation, consequences, establishes; with quotes
+3 d 4 h
Nov 5 16:45
The Crypto Guardian adds
Adds $100M, with quotes

Thefts of a similar size

WhenWhat happenedFigure
8 days ago Binance CEX · Key Leaked via Infrastructure incident $6.4B
8 days ago Binance · DevOps Engineer’s laptop compromised incident $6.3B
5.9 years ago LuBian · Weak key generation incident $3.5B
5.5 years ago Thodex · Scam incident $2.5B
5.4 years ago Africrypt · Scam incident $2.3B

4280 incidents stored · 0 were as large as this one or larger ($235B)