Suspected $106M+ theft from an EU entity's exchange accounts, laundered via ETH, instant exchanges and Monero

Summary

On-chain investigator ZachXBT reported on 2 November 2026 that an unnamed entity in the European Union is suspected of losing more than $106M from multiple centralized exchange accounts on 1 November 2026. The suspected stolen funds were withdrawn as USDC and USDT by an unidentified illicit actor, who has since been swapping USDC for ETH, using instant exchanges, converting to Monero and bridging across chains. The victim and the affected exchanges have not been named.

Affected

• An unnamed EU-based entity's accounts at multiple centralized exchanges (exchanges not disclosed)
• No fix applicable; this is a theft from custodial accounts, and the access method has not been disclosed

Impact

More than $106M in USDC and USDT is suspected stolen, per ZachXBT. Over the following 24 hours the actor swapped USDC for ETH, transferred funds to instant exchanges (WellWallet, Kyrrex, etc.), converted to XMR via Wagyu, and bridged across multiple chains. ZachXBT states with a high degree of confidence that the actor is NOT Lazarus Group, based on laundering indicators. The loss has not been confirmed by the victim or the exchanges at time of publication, and the attack method is unknown.

Recommended actions

• Exchanges, instant-swap services, bridges and stablecoin issuers: screen deposits and flows against the 11 theft addresses listed in the IOCs and flag or freeze where possible.
• Institutions holding funds on centralized exchanges: review API keys, withdrawal allowlists, and account access logs.

Source & attribution

This 0xCERT advisory summarises a community alert by ZachXBT: https://t.me/investigations/372. Reported independently by Decrypt (https://decrypt.co/382383/mystery-106-million-crypto-theft-eu-entity-binance-hack) and CoinDesk. Details may change; refer to the original source for the authoritative record.