ZachXBT raises suspected EU crypto theft estimate to over $133M

Key facts

• ZachXBT said the additional $27 million came from exchange withdrawals, some made after his first disclosure.
• ZachXBT said his working theory is that a large Western European financial institution was exploited and is being covered up.
• ZachXBT said the lack of a proper incident disclosure allowed more than $30 million to be laundered.
• Bitquery reported $62.98 million in stablecoins was converted into 27,553 Ether within roughly four hours.
• Bitquery reported only $3.74 million remained in USDC that issuer Circle could potentially freeze.
• ZachXBT said the laundering patterns did not match those typically used by North Korea's Lazarus Group.

Blockchain investigator ZachXBT said on November 3, 2026 that he had raised his estimate of a suspected crypto theft from an unidentified European Union entity to more than $133 million, from the $106 million he first reported on November 2. He said he identified another $27 million in withdrawals from centralized exchanges, some of which occurred after his primary disclosure.

"My working theory is a large financial institution in Western Europe was exploited and it's currently being covered up," ZachXBT said on his Telegram channel. He also said the lack of a proper incident disclosure allowed more than $30 million to be laundered, claiming EU law enforcement could otherwise have frozen the funds. The victim's identity and the cover-up allegation remain unverified.

Bitquery reported that $62.98 million in stablecoins was converted into 27,553 Ether within roughly four hours. As of 13:47 UTC on November 2, about $78.3 million remained in wallets linked to the suspected attacker, while $30.5 million had moved out of the tracked addresses. Only $3.74 million remained in USDC that issuer Circle could potentially freeze, according to Bitquery.

ZachXBT said earlier that the attacker was swapping funds into Ether and Monero through instant exchanges and cross-chain bridges. He added that the laundering patterns did not match those typically used by North Korea's Lazarus Group.