EU crypto entity faces suspected $106 million theft across exchanges

Traders Union
All News
Crypto
EU crypto entity $106M theft

Highlights

ZachXBT reports a suspected $106 million crypto theft from an unidentified EU entity, with funds withdrawn as USDC and USDT across multiple exchanges.
Stolen assets are rapidly exchanged into ether and Monero using services like WellWallet, Kyrrez, and Wagyu to obscure tracing and evade token freezes.
The incident follows recent large-scale breaches including a $6.4 billion theft from Binance and $40 million at Mercado Bitcoin, intensifying scrutiny on crypto sector security and compliance.

Fund flows and tracing activity

As reported by CoinDesk, citing ZachXBT in a Monday Telegram alert, the suspected attacker withdraws funds in USDC and USDT from accounts at several cryptocurrency exchanges and then moves them across multiple blockchains and swap services. The blockchain investigator says the victim and the affected exchanges are not identified, and the reported losses are not independently confirmed.

Over the next 24 hours, the funds are exchanged from USDC into ether and routed through instant-exchange services including WellWallet and Kyrrez. ZachXBT also says part of the proceeds is converted into Monero through Wagyu, while publishing 11 wallet addresses allegedly linked to the suspected theft.

That conversion path matters because Monero obscures transaction details, making stolen funds more difficult to track. Unlike USDC and USDT, which can in some cases be frozen by their issuers, ether and Monero do not have a central issuer able to block transfers in the same way.

Broader pressure on crypto security

The case adds to a run of high-value crypto security incidents that are keeping pressure on exchanges, custodians and trading firms to tighten account protection and monitoring. ZachXBT rules out one prominent suspect, but does not explain how access to the accounts is allegedly obtained.

The suspected theft emerges only days after hackers steal about $6.4 billion from Binance in an attack the FBI attributes to North Korea's TraderTraitor group, which is associated with Lazarus. BTCPay is also attacked after the Binance exploit, and Mercado Bitcoin apparently suffers a separate crypto theft worth about $40 million.

Neither the EU entity nor any of the exchanges involved publicly confirms the latest suspected theft. The absence of official confirmation leaves the scale and counterparties unclear, but the reported movement of funds across exchanges and privacy-focused assets underscores the operational and compliance challenges facing the crypto sector.

Our earlier article on Q3 2026 cybersecurity funding highlighted that investor appetite stayed strong as bigger late-stage rounds lifted total capital raised to $6.8 billion despite fewer deals. We noted that AI-driven and identity security companies attracted much of the funding, alongside continued consolidation through large acquisitions aimed at strengthening fraud detection and protection.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.