An unnamed entity in the European Union reportedly lost over $106 million following an unauthorized withdrawal from multiple accounts on centralized cryptocurrency exchanges. The incident, which occurred on Sunday, involved the theft of USDC and USDT stablecoins and has amplified security concerns in the industry, coming just days after a record-setting hack at Binance.
ZachXBT tracks attackers’ laundering trail
Onchain investigator ZachXBT, who is known for uncovering cryptocurrency scams and major hacks, disclosed the breach on Monday through his Telegram channel. ZachXBT identified 11 Ethereum addresses involved in moving the stolen funds and noted that the attacker used a complex series of laundering steps.
According to ZachXBT, the thief first converted the USDC and USDT into Ethereum, then utilized instant exchanges to rapidly swap assets, moving the proceeds into Monero, a cryptocurrency favored for its privacy features. The attacker also bridged funds across multiple blockchain networks, further complicating efforts to track and recover the assets.
Mini dictionary: Instant exchanges are platforms that allow users to swap one cryptocurrency for another quickly, usually requiring minimal identity verification, making them popular for rapid conversions. Monero is a privacy-focused cryptocurrency that obscures transaction details such as senders, receivers, and amounts, which makes it especially attractive to those seeking to launder or hide funds.
This laundering strategy reflects tactics previously seen in other major hacks, but ZachXBT stated that the indicators point away from involvement by North Korea’s Lazarus Group.
ZachXBT expressed with “a high degree of confidence” that the EU theft is not linked to Lazarus Group. He cited unique laundering patterns and multiple technical indicators as the basis for his assessment, distinguishing this attack from previous North Korean-linked incidents.
Comparison with Binance hack and industry response
The European theft follows closely on the heels of the Binance attack, in which hackers stole approximately $6.4 billion from the world’s largest cryptocurrency exchange last Thursday. The scale of the Binance hack prompted a swift response from stablecoin companies: Tether froze stolen USDT on Ethereum within 37 minutes, and Circle froze $823 million in stolen USDC, ultimately securing around 44% of the hacked funds, according to blockchain analytics firm Elliptic.
| Incident | Date | Amount Stolen | Victim | Funds Frozen |
|---|---|---|---|---|
| EU Entity Hack | Sunday (Nov. 1) | $106 million | Unnamed EU entity | Unknown |
| Binance Hack | Thursday | $6.4 billion | Binance | $823 million (Circle USDC), USDT (Tether) frozen |
ZachXBT did not specify whether any of the stolen assets from the EU entity were frozen by stablecoin issuers. Swapping funds out of USDC and USDT is often intended to avoid asset freezes, as these companies have the authority to block certain transactions and seize compromised tokens.
Cascade of exchange attacks and mounting concerns
The EU hack is part of an escalating wave of security incidents affecting cryptocurrency exchanges worldwide. On Tuesday, Brazilian exchange Mercado Bitcoin reported a $40 million loss and temporarily suspended withdrawals. In addition, BTCPay Server, a company providing crypto payment processing solutions, warned merchants to shut down their servers following reports of hot wallet attacks.
These incidents underscore a challenging period for the cryptocurrency industry, highlighting vulnerabilities in both centralized and decentralized systems. As hackers employ increasingly sophisticated tactics and move funds across various platforms and blockchain networks, exchange operators and regulators face mounting pressure to enhance security measures and monitor laundering activity.
Elliptic, a blockchain analysis firm, noted that issuing companies were able to freeze nearly half of the stolen assets in the Binance case within minutes, while much remains unknown regarding the latest EU theft.
