An unidentified entity within the European Union reportedly lost more than $106 million from accounts held at several cryptocurrency exchanges on Sunday, according to blockchain investigator ZachXBT.
Multichain transfers and laundering attempts
ZachXBT reported that the funds, believed to be illicitly withdrawn, were initially moved out in the stablecoins USDC and USDT. The suspected perpetrator quickly converted these assets into Ether (ETH), then utilized rapid exchange platforms such as WellWallet and Kyrrex, platforms designed for instant crypto asset swaps.
Investigators stated that after these conversions, the attacker further obscured the funds’ path by exchanging assets for Monero (XMR) through the crypto swap service Wagyu. Monero is a cryptocurrency known for prioritizing privacy and non-traceability of transactions.
Mini dictionary: Wagyu is a decentralized swap service that facilitates anonymous exchanges between cryptocurrencies, often used to enhance privacy in fund transfers across blockchains.
While the entities and exchanges involved have not been identified, ZachXBT stated that he tracked 11 wallet addresses tied to the stolen assets. He noted that the movement of funds did not appear to be linked to North Korea’s Lazarus Group, a notorious group associated with numerous high-profile crypto thefts in recent years.
Funds traced through multiple blockchain networks did not follow typical patterns associated with North Korea’s Lazarus Group, suggesting a separate actor was likely involved in this sizable theft.
The cyberattack occurred against the backdrop of previous major hacks, notably the Binance exploit from October 29, 2022, which resulted in losses of $6.3 billion. The FBI has attributed that record-breaking incident to North Korean hackers known as “TraderTraitor,” a collective linked to the Lazarus Group.
| Incident | Date | Attributed Group | Loss ($) |
|---|---|---|---|
| Binance Hack | Oct 29, 2022 | Lazarus Group (“TraderTraitor”) | 6.3 billion |
| EU Exchange Accounts | June 2024 | Unknown | 106 million |
Solana arbitrage bot ‘King’ targeted in separate incident
In a separate case, a wallet associated with King, an automated trading bot operating on the Solana blockchain, reportedly suffered losses of approximately $786,000 on Monday. King is an arbitrage bot, which automatically trades digital assets across different markets to exploit price discrepancies.
Blockchain monitoring account Onchain Lens flagged the suspicious activity, observing that the compromised funds were rapidly routed through several Solana wallets and subsequently bridged to Ethereum using Mayan, a cross-chain transfer service. Onchain Lens pointed to the unusual speed and complexity of the transactions as signs of a probable wallet compromise.
Mini dictionary: Mayan is a protocol that enables the transfer of assets between various blockchain networks, facilitating cross-chain liquidity for cryptocurrencies and tokens.
Onchain Lens stated that the quick movements and cross-chain transfers suggested an intentional effort to mask the source of the funds, raising the likelihood that the wallet controlling the bot had been compromised.
The exact identity of the attacker in both incidents remains unknown. No public statement has been made by the affected exchanges or the entity behind the King arbitrage bot.
