European Entity May Have Lost $106 Million in Multi-Exchange Theft

An unnamed European entity is suspected of losing over $106 million from accounts on multiple crypto platforms on 1 November. Within minutes, millions of dollars were shifted across cryptocurrency wallets.

Blockchain investigator ZachXBT issued a warning on Monday. The alleged attacker reportedly withdrew USDC and USDT, two tokens designed to maintain a $1 value.

BeInCrypto's examination of Ethereum transactions found roughly $80 million in USDC reaching 11 wallets over a span of 11 hours. Across five wallets, about $9.6 million was moved out again within three minutes.

The $106 million estimate includes USDT. Neither the victim nor any exchange has publicly confirmed the suspected theft.

Why Were the Funds Transferred So Rapidly?

The firms behind USDC and USDT, Circle and Tether, have the power to halt those tokens. Ethereum's own coin, ETH, lacks any such central authority.

ZachXBT reports that the alleged thief swapped USDC for ETH, moved money via instant-exchange platforms such as WellWallet and Kyrrex, and employed Wagyu to turn a portion into Monero (XMR).

Monero's privacy features make it tougher to follow the pilfered assets. Additional funds were transferred across blockchain networks.

Curiously, at least five of the identified wallets had previously received modest payments from the same origin months prior. That prompts queries but does not clarify the timeline or method of the breach.

Should Users of EU Crypto Exchanges Be Worried?

The identity of the victim and which exchanges were involved have not been disclosed. The method used in the attack is likewise unclear. So far, there is no public proof that everyday EU customers have been affected on a broader scale.

This event comes after the $6.3 billion Binance hack on October 29. Nevertheless, ZachXBT says he has “a high degree of confidence” that the perpetrator is not the Lazarus Group, which is linked to North Korean cryptocurrency heists.

• For the time being, those using exchanges ought to check their account history and eliminate any unknown API keys.
• They should also turn on two-factor authentication, ideally with passkeys or authenticator apps.
• Enable restrictions on withdrawal addresses when possible.

Users who notice anything suspicious ought to get in touch with their exchange via official avenues without delay.

These steps are consistent with EU cybersecurity guidelines.