Key facts
- ZachXBT said the suspected theft hit several centralized exchange accounts belonging to an unnamed EU entity.
- ZachXBT published 11 Ethereum addresses tied to the suspected theft and said the attacker is likely not Lazarus Group.
- The affected entity and the exchanges involved have not been publicly named, and the suspected attacker remains unidentified.
- Onchain Lens said a wallet tied to the Solana arbitrage bot King may have lost about $786,000 on Monday.
- King's operator has not confirmed a compromise, Onchain Lens told Cointelegraph.
- It is unclear whether any funds in the EU case have been frozen, per the report.
An unidentified entity in the European Union is suspected of losing more than $106 million from accounts at several cryptocurrency exchanges on November 1, pseudonymous onchain investigator ZachXBT said in a post to his Telegram channel. The funds were withdrawn in USDC and USDT by what he described as an illicit actor. ZachXBT did not name the victim or the exchanges involved.
In the 24 hours that followed, the actor moved to obscure the funds, ZachXBT said. The attacker swapped USDC for ether, sent funds through instant exchange services including WellWallet and Kyrrex, converted some to the privacy coin Monero via Wagyu and bridged assets across multiple blockchains. ZachXBT published 11 Ethereum addresses tied to the theft.
Instant exchanges let users swap one cryptocurrency for another with little identity verification, while Monero hides senders, receivers and amounts. Moving out of USDC and USDT also matters because the companies behind those stablecoins can freeze them. ZachXBT said the culprit remains unidentified but that he could say with a high degree of confidence it is not Lazarus Group, citing multiple laundering indicators.
Separately, a wallet associated with King, an automated trading bot on Solana, may have lost about $786,000 on Monday, according to pseudonymous blockchain monitoring account Onchain Lens. Onchain Lens told Cointelegraph the funds moved through several Solana wallets before being transferred to Ethereum using Mayan, a service for moving assets between blockchains. It said the rapid transfers suggested an attempt to conceal the funds' origin and a possible wallet compromise. King's operator has not confirmed a compromise.
"Our report is based on unusual fund movements, rapid transfers and the subsequent cross-chain movement of funds, which we believe indicates an attempt to obscure their origin," Onchain Lens told Cointelegraph. "This pattern strongly suggests a potential wallet compromise."