On Monday, November 2, 2026, CoinDesk reported that an unidentified European Union entity may have lost more than $106 million in cryptocurrency from accounts held at multiple exchanges, citing a report by blockchain investigator ZachXBT.
The losses occurred Sunday, according to ZachXBT’s alert on Telegram. The term “entity” could refer to a company, trading firm, or investment fund, though the investigator did not specify which. He also did not name the victim or the affected exchanges, nor did he explain how the attacker gained access to the accounts.
ZachXBT said the suspected attacker first withdrew funds in the dollar-pegged stablecoins USDC and USDT. Over the next 24 hours, the funds were swapped for ether and routed through instant-exchange services, including WellWallet and Kyrrez. Some of the money was then converted into Monero, a privacy-focused cryptocurrency
Monero conceals transaction details, which makes tracing funds
Monero conceals transaction details, which makes tracing funds more difficult. Ether and Monero also cannot be frozen by a central issuer, unlike USDC and USDT, whose issuers have that ability.
ZachXBT published 11 wallet addresses tied to the suspected theft. He said he could state “with a high degree of confidence” that North Korea-linked Lazarus Group was not responsible, citing multiple laundering indicators. The actor’s identity remains unknown.
The incident follows a separate attack days earlier in which hackers stole about $6.4 billion from Binance. The FBI attributed that attack to TraderTraitor, a North Korean group associated with Lazarus. BTCPay was also targeted after the Binance exploit, and Mercado Bitcoin reportedly suffered a theft of roughly $40 million.
The reported losses have not been independently confirmed. Neither the EU entity nor any exchange involved has publicly acknowledged the latest suspected theft.
