Blockchain investigator ZachXBT has revised his estimate of a major cryptocurrency theft involving an unidentified entity based in the European Union, putting the total losses at more than $133 million. The researcher shared his latest calculations and observations through his Telegram channel, suggesting that the real scale of the incident may be underreported.
Funds reportedly traced to Western European financial institution
ZachXBT stated on Tuesday that his analysis points to a significant financial institution in Western Europe as the likely victim of the exploit. He suggested the incident might be subject to concealment, with little official acknowledgment or disclosure from any implicated organization.
My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up.
While the suspected target remains unnamed, blockchain data has captured a rapid movement of digital assets shortly before and after the attack came to light. Independent analysis from Bitquery found that $62.98 million in stablecoins was converted into 27,553 Ether (ETH) over a four-hour period, with the transactions conducted across multiple wallets linked to the suspected attacker.
Laundering methods and asset breakdown
By Monday afternoon at 13:47 UTC, wallets believed to be controlled by the attacker still held approximately $78.3 million. At that point, $30.5 million in assets had already been moved out of the tracked addresses. The latest figures indicate that only $3.74 million in USDC, which issuer Circle could potentially freeze, remained in the compromised wallets.
According to ZachXBT, the attacker utilized a series of instant exchanges and cross-chain bridges to transfer stolen funds into both ETH and Monero (XMR), a privacy-focused cryptocurrency. He noted that the offloading and laundering process did not resemble the methods commonly associated with North Korean hacking groups such as Lazarus Group.
ZachXBT observed that the laundering patterns did not match those used by North Korea’s Lazarus Group, reinforcing the theory that a different entity was behind the theft.
These on-chain maneuvers highlight the evolving complexity of illicit fund flows and the challenge investigators face in tracing stolen digital assets through decentralized and privacy-enhancing technologies.
With the situation developing and the identity of the compromised institution still unknown, market participants may want to keep a close watch on large fund movements and significant shifts in ETH and XMR transfers. For users and analysts tracking such high-impact events in real time, CryptoAppsy provides live chart tools and customizable price alerts that can help monitor sudden asset flows associated with major incidents. Leveraging these features can offer early signals of suspicious transaction patterns across the most affected tokens.
