Kraken announced on Thursday that it had restricted a set of accounts linked to a suspected theft of more than €133 million (about $145 million) involving an unidentified European entity. The exchange said the move was part of a coordinated effort with law‑enforcement agencies to prevent further movement of the stolen assets, and emphasized that its own security and customer accounts were not compromised.

Scale of the alleged theft

Blockchain investigator ZachXBT first reported the incident on November 2, estimating losses above €106 million. A follow‑up analysis on November 3 added roughly €27 million in additional withdrawals, bringing the total to over €133 million, according to the investigator. ZachXBT suggested the victim could be a major Western European financial institution, though that claim remains unverified.

How the funds moved

Analytics firm Bitquery traced the stolen assets through accounts on Kraken, Crypto.com and OKX. Within about four hours, $62.98 million of stablecoins were swapped for 27,553 Ether (ETH). The attacker also used cross‑chain bridges, instant exchanges and converted part of the haul into Monero (XMR) to obscure the trail. By the time of the latest snapshot, roughly $78.3 million remained in wallets associated with the suspect, while $30.5 million had already been moved out.

Response from exchanges and stablecoin issuers

Kraken confirmed that the restricted accounts were not the source of the breach and that its internal security controls remained intact. Crypto.com said it had blocked the related funds from further transfers, and OKX indicated it was reviewing the activity. Stablecoin issuers also took action: Circle froze about $3.74 million of USDC, and Tether locked roughly $1.1 million of USDT. ZachXBT warned that delayed public disclosure may have allowed more than $30 million to be laundered that could otherwise have been frozen.

What to watch next

Authorities and blockchain analysts continue to monitor the remaining wallets, looking for additional exits or links to identifiable accounts. Future updates may reveal whether any of the frozen stablecoins can be recovered, and whether the suspected European victim will be publicly identified. The incident also underscores the need for faster information sharing between exchanges, stablecoin issuers and law‑enforcement to limit the rapid outflow of stolen crypto.