EU Entity Suffers $106M Crypto Hack
Key Summary
An unidentified attacker stole $106M in stablecoins from an EU-based entity, laundering the assets through ETH swaps and Monero privacy features while blockchain investigator ZachXBT ruled out North Korea's Lazarus Group.
Key Bullets
- Blockchain investigator ZachXBT tracked the theft of $106M in USDC and USDT from a European Union entity on November 1.
- The hacker swapped stolen stablecoins into ETH before bridging assets across instant venues like WellWallet and Kyrrex.
- Illicit funds were ultimately converted into privacy coin XMR to obscure transaction histories and hinder recovery efforts.
- Regulatory pressure mounts as the European Banking Authority recognizes USDC under MiCA while restricting non-compliant tokens.
Attacker Drains $106M From EU Accounts
An unidentified hacker drained more than $106M in Circle USDC and Tether USDT from accounts held across multiple centralized exchanges on November 1. According to public findings published by blockchain investigator ZachXBT, the stolen assets belonged to an undisclosed European Union entity.
CEX order-book monitoring revealed the sudden outflow of funds. The victimized EU entity has not yet released a formal public statement regarding the breach. Market participants monitored exchange withdrawal limits closely.
Laundering Route Involves ETH and Monero
The illicit actor immediately swapped the stolen stablecoins into ETH to initiate the laundering sequence. On-chain transaction records confirm the ETH was then routed through instant cryptocurrency platforms including WellWallet and Kyrrex.
The attacker converted the remaining assets into privacy-focused token Monero to obscure transaction histories, sender addresses, and final recipient balances. Privacy features on the Monero network prevented further automated tracing by on-chain analysts.
ZachXBT Rules Out Lazarus Group Attribution
Despite the scale of the exploit and the multi-step laundering path, ZachXBT confirmed the incident did not originate from North Korea's Lazarus Group. The investigator cited distinct laundering indicators and operational signatures inconsistent with known state-sponsored syndicates.
Security teams at major centralized exchanges updated their internal blacklists to flag deposit addresses tied to the exploit. Funds remain frozen across several intermediary routing nodes.
Regulatory Tightening Follows Massive Exploit
Filings with European regulatory bodies indicate the breach coincides with major supervisory updates from the European Banking Authority. The agency recently recognized USDC as a primary e-money token under strict Markets in Crypto-Assets frameworks.
Meanwhile, the European Securities and Markets Authority directed national regulators to restrict trading services involving non-compliant stablecoins. Regional exchanges must limit non-compliant tokens strictly to sell-only, conversion, and withdrawal operations.
About CryptoNewsFree Market Intelligence Wire
The CryptoNewsFree Market Intelligence Wire provides rapid, objective coverage of breaking crypto developments, regulatory actions, and market liquidity trends. Our reporting strictly follows our Editorial & Verification Standards.