ZachXBT: More than $133 million may have been stolen from exchange accounts, victim is a European financial institution

Blockchain analyst ZachXBT reported a probable theft of over $133 million from several accounts on centralized crypto exchanges. According to him, the incident occurred on November 1, 2026, and a European financial institution may have been affected.

How the assessment changed

Initially, the researcher estimated the damage at more than $106 million, then identified additional withdrawals from centralized exchanges amounting to another $27 million – the total estimate rose to over $133 million. Some of these operations took place after his first report.

How the funds were withdrawn

Within 24 hours, the perpetrator actively exchanged USDC for Ethereum, then sent the assets to instant exchange services, including WellWallet and Kyrrex. The funds were then converted into Monero via the Wagyu service and moved between blockchains through cross-chain bridges.

The identity of the perpetrator has not yet been established by ZachXBT. However, based on identified laundering indicators, he confidently excludes the involvement of the North Korean Lazarus Group.

Researcher's version

According to his hypothesis, the victim could be a large financial institution in Western Europe, attempting to conceal the incident. He did not provide evidence for this version and did not name a specific organization. ZachXBT also stated that without timely disclosure of information, the perpetrator could have laundered more than $30 million, and believes that EU law enforcement could have frozen these funds if they had received the information in time.