Critical0xCERT-2026-0315·2026-11-01

Unidentified EU Institution $133M Crypto Theft

About $133 million in stablecoins was drained from an unidentified European entity's exchange accounts over one weekend, in a suspected owner-side key compromise.

Vuln-watch · relayed from a public source; see Source & attribution below

Affected chainsEthereum

Summary

About $133 million in stablecoins was drained from an unidentified European entity's exchange accounts over one weekend, in a suspected owner-side key compromise.

Incident

Victim: Unidentified EU Institution
Date (UTC): 2026-11-01
Estimated loss: $133.0M
Chain(s): Ethereum
Attack type: private key compromise
Funds status: stolen

Recommended actions

If you use Unidentified EU Institution, move funds to a fresh wallet with a new seed phrase once the vendor confirms the root cause
Update the wallet software only from official sources
Beware of follow-on phishing: ignore unofficial "refund", "recovery", or "claim" links and DMs; use the project's verified channels only

Source & attribution

Full analysis on Blockchain Breaches, 0xCERT's incident archive: https://www.blockchainbreaches.com/en/breaches/unidentified-eu-institution-2026. Primary sources: https://cointelegraph.com/news/zachxbt-flags-suspected-106m-crypto-theft-as-solana-bot-faces-possible-786k-drain ; https://cointelegraph.com/news/zachxbt-eu-crypto-theft-133m-alleged-cover-up ; https://www.coingabbar.com/en/crypto-exchange-theft-zachxbt-133m-laundering.

References

Indicators of compromise

All IOC feeds →

address0x12d9012731eb0d54871a31af5566eb9ecca351dbTheft address listed by ZachXBT (EU institution theft, initial alert) · Ethereum
address0x29e9d7715d935e0d0d4b0dd0efc952a97e551020Theft address listed by ZachXBT (EU institution theft, initial alert) · Ethereum
address0x378b4f150707c283574dc89739608d29036d57d5Theft address listed by ZachXBT (EU institution theft, initial alert) · Ethereum
address0x3e6c3d135ca8f8be793e5fe1715ce6c057d140f2Theft address listed by ZachXBT (EU institution theft, $133M+ update) · Ethereum
address0x5a154f77852ed274fd6f4c324a1ee27809052ff7Theft address listed by ZachXBT (EU institution theft, initial alert) · Ethereum
address0x5cf70edce65847ef989933c3072fb0e7f335abc1Theft address listed by ZachXBT (EU institution theft, $133M+ update) · Ethereum
address0x730bcb1296758c377149d7409f98f041cf723992Theft address listed by ZachXBT (EU institution theft, initial alert) · Ethereum
address0x795a9d22f233024487161fe6daff73397c162621Theft address listed by ZachXBT (EU institution theft, initial alert) · Ethereum
address0x8a97bc406180e28b11c5495fa099bf5119c6c6b0Theft address listed by ZachXBT (EU institution theft, initial alert) · Ethereum
address0x90f0b6d51ed2fe2348a45b2c49bc441e959bc557Theft address listed by ZachXBT (EU institution theft, initial alert) · Ethereum
address0x99d314e6970b8d3db0dbe6f6e041cc904143400fTheft address listed by ZachXBT (EU institution theft, $133M+ update) · Ethereum
address0xa1096a66f9ed58a9594a6a1ad67a5472c0907224Theft address listed by ZachXBT (EU institution theft, initial alert) · Ethereum
address0xadd95cd98e0288ba69785e3151e1db86adf8dd58Theft address listed by ZachXBT (EU institution theft, initial alert) · Ethereum
address0xd010cba790a6ab0048da18f2fbe8e3faf463a16aTheft address listed by ZachXBT (EU institution theft, initial alert) · Ethereum
address0xe378cdccb369a64a0190577787ef61ca2eefa6b2Theft address listed by ZachXBT (EU institution theft, $133M+ update) · Ethereum

OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.

Published 2026-11-01 · last updated 2026-11-06

curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0315/signed.txt | gpg --verify