On November 1, an unidentified organization in the European Union suffered a massive crypto theft estimated at more than $106 million. The loss was reported by on‑chain investigator ZachXBT, who traced the movement of USDC and USDT from several exchange accounts to a series of wallets and services before a portion was converted into the privacy‑focused coin Monero (XMR). No exchange or the victim has publicly confirmed the breach, and the identity of the attacker remains unknown.

How the Funds Were Moved

ZachXBT’s analysis shows the thief first withdrew stablecoins—USDC and USDT—then aggressively swapped the USDC for Ether (ETH) within a 24‑hour window. Approximately $80 million in USDC was sent to eleven wallets over eleven hours, with five of those wallets moving about $9.6 million onward in under three minutes. The ETH was routed through instant‑exchange platforms such as WellWallet and Kyrrex, and a portion of the value was bridged to other blockchains, including a Tron‑format address.

Conversion to Monero and Remaining Trail

After passing through the instant‑exchange services, the attacker used the swap service Wagyu to convert part of the proceeds into Monero. Because Monero obscures sender, receiver and amount data, the final destination of those funds is difficult to trace. The on‑chain flow graph, compiled with input from Specter and TRM Labs, still shows the public Ethereum addresses holding the remaining balances, but the Monero leg is effectively hidden.

Attribution and Security Implications

ZachXBT emphasized that, based on multiple laundering indicators, he is highly confident the theft is not linked to North Korea’s Lazarus Group, which was recently tied to a separate Binance hot‑wallet breach. The investigation also noted that five of the flagged wallets had received smaller payments from the same source months earlier, though this does not clarify how the initial compromise occurred. Security experts advise exchange users to audit recent activity, revoke unknown API keys, enable two‑factor authentication and, where possible, set withdrawal address restrictions.

What to Watch Next

Authorities and the exchanges involved have not commented, leaving the scope of the breach uncertain. Follow‑up reporting will focus on any identification of the victim or compromised exchanges, potential law‑enforcement involvement, and whether additional funds are moved out of Monero. Monitoring of the flagged Ethereum addresses and any new activity on related instant‑exchange services will be critical for tracking the attacker’s next steps.