ZachXBT Traces $106M Suspected Theft Through ETH and Monero

An EU entity is suspected of losing more than $106 million from accounts at several centralized exchanges on Sunday, Nov. 1, on-chain investigator ZachXBT said in a post on his Investigations channel. He said the suspected stolen funds were withdrawn as USDC and USDT by an illicit actor.

The post does not name the victim or the exchanges. The method of attack is also not known, and the split between USDC and USDT inside the $106 million figure has not been given.

Stablecoins Swapped Into ETH, Then Monero

ZachXBT described the actor spending the following 24 hours moving the money quickly through several layers:

• Swapping USDC for ETH
• Sending funds to instant exchanges, including WellWallet and Kyrrex
• Converting to Monero (XMR) through Wagyu
• Bridging across multiple chains

The order matters for anyone hoping to recover the money. USDC and USDT issuers can freeze tokens at specific addresses. ETH and Monero cannot be frozen that way, and Monero hides transaction details by design. Each step in that chain takes the funds further from the point where a freeze would be possible.

ZachXBT published 11 theft addresses alongside the post, including 0xADd95cD98E0288ba69785E3151E1db86adF8Dd58.

Not Lazarus Group, ZachXBT Says

The actor has not been identified. ZachXBT said he could state "with a high degree of confidence it is NOT Lazarus Group based on multiple laundering indicators." He did not set out those indicators in the post, so the attribution rests on his own assessment for now.

The case lands days after another large incident. An earlier post on the same channel said the Arbitrum Security Council had executed a transaction to freeze about $30.5 million from what ZachXBT called "the Binance Exploit." That freeze is a reminder of what this actor appears to have avoided: much of the $106 million left the stablecoin rails within a day.

The open questions are the ones that decide whether any money comes back. Those are who the victim is, which exchanges held the accounts and how the attacker got access. Until a victim or exchange confirms the loss, the $106 million remains ZachXBT's estimate of a suspected theft.