ZachXBT raises suspected EU crypto theft estimate to $133M

What happened

Blockchain investigator ZachXBT has increased his estimate of a suspected cryptocurrency theft connected to an unidentified European Union entity to more than $133 million, after tracing a further $27 million in withdrawals from centralized exchanges. The revised figure, published on Tuesday, compares with the roughly $106 million he first reported a day earlier.

According to the investigator, some of the additional withdrawals took place after he had already disclosed the suspected theft publicly. He said the newly identified transactions were linked to the same actor behind the earlier alert, and the update added four more wallet addresses to the publicly identified set, bringing the total across both disclosures to 15.

In a post on his Telegram channel, ZachXBT said his working theory is that a large financial institution in Western Europe was exploited and that the matter is currently being covered up. He also argued that the absence of a proper incident disclosure allowed more than $30 million to be laundered, funds he said EU law enforcement could otherwise have frozen. The identity of the alleged victim and the cover-up allegation have not been verified.

Why it matters

The case draws attention to the gap between on-chain detection and formal disclosure. According to the investigator, the delay in reporting the suspected incident gave the alleged attacker time to move funds beyond the reach of authorities, and he contends that a timely disclosure would have given European law enforcement a chance to freeze assets. Because most of the stablecoins were swapped into ether and other assets, only a small residual balance in USDC remained in a form that issuer Circle could potentially freeze, according to Bitquery's figures.

The investigation also adds to a running record of large suspected thefts traced through instant exchanges, cross-chain bridges and privacy-focused assets, routes that have appeared in earlier cases ZachXBT has documented. His assessment that the Lazarus Group is not responsible, based on differences in laundering behavior, matters for how the incident may be attributed and pursued.

What the data shows

Bitquery reported that $62.98 million in stablecoins was converted into 27,553 ether within roughly four hours. As of 13:47 UTC on Monday, about $78.3 million remained in wallets linked to the suspected attacker, while $30.5 million had moved out of the tracked addresses. Only $3.74 million was left in USDC that Circle could potentially freeze, according to Bitquery.

ZachXBT's original findings described withdrawals in two dollar-pegged stablecoins, USDC and USDT, followed by swaps of USDC into ether over the next 24 hours. Portions of the assets were sent to instant exchanges including WellWallet and Kyrrex, while another route involving Wagyu converted funds into monero. Other transactions bridged assets between networks.

Background

The inquiry began with a community alert on Nov. 2, when ZachXBT reported that an unidentified European entity was suspected of losing more than $106 million from several centralized exchange accounts on Nov. 1. He published multiple wallet addresses and a transaction map showing how the assets moved between wallets, exchanges and other crypto services.

Monero and instant-exchange routes have featured in earlier investigations by the same researcher. In June, crypto.news reported that Tether froze $72 million in USDT after ZachXBT traced about $120.2 million through services and transactions linked to monero purchases, following movements through Tron, KuCoin, instant exchanges and NEAR Intents wallets. An Oct. 20 investigation linked FreedomXMR inflows on Hyperliquid Core to suspected illicit activity, with ZachXBT estimating that more than 87% of the service's incoming funds came from illicit sources. Separately, an October probe into a Bybit laundering network described an alleged Chinese criminal operation that he said had processed more than $1 billion tied to North Korean hackers, work that led Tether to freeze 442,000 USDT.

What is still unclear

It remains unknown which organization is alleged to have lost the funds, and no institution has been publicly identified. The allegation of a cover-up is unverified, as is the total size of any loss; the figure has already been revised upward once as further withdrawals were linked to the same addresses. Whether any law enforcement agency has opened an investigation or sought freezes has not been disclosed.

What to watch

The next signals to watch are whether the estimate rises again as more addresses are linked, whether stablecoin issuers act on any remaining balances, and whether a named institution or regulator confirms an incident. Any formal disclosure from a European entity, or a statement from EU law enforcement, would test the investigator's account.

Questions readers ask