-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0305
============================================================

Advisory-ID:  0xCERT-2026-0305
Severity:     Critical
Published:    2026-11-02T12:28:49.000Z
Updated:      2026-11-03T12:44:20.815Z
Chains:       Ethereum
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0305

Title: Suspected $106M+ theft from an EU entity's exchange accounts, laundered via ETH, instant exchanges and Monero

Summary
- -------
ZachXBT reports an unnamed EU entity is suspected of losing $106M+ in USDC/USDT from several centralized exchange accounts on 1 Nov 2026. The actor is laundering via ETH, instant exchanges and Monero. Exchanges and issuers should screen the 11 published theft addresses.

Details
- -------
Summary
On-chain investigator ZachXBT reported on 2 November 2026 that an unnamed entity in the European Union is suspected of losing more than $106M from multiple centralized exchange accounts on 1 November 2026. The suspected stolen funds were withdrawn as USDC and USDT by an unidentified illicit actor, who has since been swapping USDC for ETH, using instant exchanges, converting to Monero and bridging across chains. The victim and the affected exchanges have not been named.

Affected
- - An unnamed EU-based entity's accounts at multiple centralized exchanges (exchanges not disclosed)
- - No fix applicable; this is a theft from custodial accounts, and the access method has not been disclosed

Impact
More than $106M in USDC and USDT is suspected stolen, per ZachXBT. Over the following 24 hours the actor swapped USDC for ETH, transferred funds to instant exchanges (WellWallet, Kyrrex, etc.), converted to XMR via Wagyu, and bridged across multiple chains. ZachXBT states with a high degree of confidence that the actor is NOT Lazarus Group, based on laundering indicators. The loss has not been confirmed by the victim or the exchanges at time of publication, and the attack method is unknown.

Recommended actions
- - Exchanges, instant-swap services, bridges and stablecoin issuers: screen deposits and flows against the 11 theft addresses listed in the IOCs and flag or freeze where possible.
- - Institutions holding funds on centralized exchanges: review API keys, withdrawal allowlists, and account access logs.

Source & attribution
This 0xCERT advisory summarises a community alert by ZachXBT: https://t.me/investigations/372. Reported independently by Decrypt (https://decrypt.co/382383/mystery-106-million-crypto-theft-eu-entity-binance-hack) and CoinDesk. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://t.me/investigations/372
- - https://decrypt.co/382383/mystery-106-million-crypto-theft-eu-entity-binance-hack
- - https://www.coindesk.com/tech/2026/11/02/eu-entity-suspected-of-losing-usd106-million-from-crypto-exchange-accounts-zachxbt-says

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrqK7QJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmcHHP9p4o2A3e8uXg/uN++4p/Vy5BjKwuNZgGcY
m2RV7xYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAACWWQD/UXEdsaC6/Gt2InTs
7cnINRWGn/WiZdkgc+/hkFwvYwQA/0S9HfZSrqKDs2yN2tYUI7eIq97uJUDe
XZaeWo+L0kgE
=uQIb
-----END PGP SIGNATURE-----