ZachXBT says an EU entity lost more than $106 million from centralised exchange accounts on 1 November. The attacker bought 27,553 ETH at $2,286 to escape stablecoin freezes, then moved into Monero.
For about five hours on Sunday, crypto Twitter had a new bull to admire. A wallet beginning 0x9eca was buying Ether in size, 27,553 ETH for $62.97 million at an average of $2,286, and on-chain trackers reported it as a whale stepping in after a rough week. Then ZachXBT published his finding: the whale was spending stolen money, drained from an EU entity's accounts at multiple centralised exchanges to the tune of more than $106 million.
Ether traded at $2,262 at 17:00 UTC on 2 November, according to recent data from CoinGecko, flat on the day and down 2.5% over seven days. The buying did not move it much. What it did do was turn frozen-able stablecoins into an asset nobody can freeze, which is the point.
According to ZachXBT's alert, posted on 2 November, an entity registered in the European Union lost more than $106 million in unauthorised withdrawals from custodial accounts at several centralised exchanges on 1 November. He has not named the entity or the exchanges.
The funds left as USDC and USDT and were spread across 11 addresses. From there the attacker did what the Binance thief failed to do fast enough four days earlier: swap out of stablecoins before Circle and Tether could blacklist them. That is where the ETH buying came from. Lookonchain's count, "27,553 ETH ($62.97M) on-chain at an average price of $2,286," covers roughly 60% of the stolen total converted in a single afternoon.
The remainder, per ZachXBT, moved through instant swap services and a cross-chain protocol into Monero, the privacy coin, which ends on-chain tracing for practical purposes.
ZachXBT's assessment is that this was not North Korea. The transfer patterns, choice of channels and laundering route differ from the Lazarus playbook, which typically swaps into ETH immediately, bridges across chains, and sits on funds for weeks before mixing. This attacker moved within 24 hours and went straight to privacy coins.
The reading is of a skilled non-state actor with knowledge of centralised exchange withdrawal mechanics. How the accounts were accessed, whether through compromised API keys, credentials, or something on the exchange side, has not been established. ZachXBT has not said.
Compliance firms are working with exchanges to flag the 11 addresses, though with most of the value already in ETH and Monero, the window for freezes has largely closed.
The incident lands in a week that has reset the scale of exchange risk. Binance lost about $6 billion on 29 October through a compromised engineer's laptop. Mercado Bitcoin, Brazil's largest exchange, confirmed a breach on 2 November that Hypernative estimates at over $40 million. The EU entity's $106 million sits between them, and it is different in kind: the victim is an exchange customer, not an exchange.
That distinction matters for who pays. Binance covered its losses from the SAFU fund. Mercado Bitcoin says its customers are whole. An institutional client whose accounts were drained at several venues at once has no such backstop unless the exchanges accept fault, and the exchanges have not been named.
It also matters for the lesson. The Binance attacker lost $2.8 billion to freezes by moving stablecoins slowly. This one converted most of the haul to ETH inside five hours. Whoever drains the next account will have read both stories.
Whether the entity or any exchange goes public. ZachXBT's alerts usually precede a disclosure by days, not weeks, and an EU-registered institution losing nine figures will have reporting obligations under MiCA. Whether the 27,553 ETH moves again, since it is sitting in traceable addresses even if it cannot be frozen. And whether any of the stablecoin remainder was caught: Tether and Circle have not announced a freeze connected to this case.
No comments yet
