ZachXBT said November 2 that an unnamed EU-based entity is suspected of losing more than $106 million from centralized exchange accounts on November 1. The suspected attacker pulled the funds out as USDC and USDT, the on-chain investigator said.
At a Glance
- ZachXBT flagged the suspected theft in a community alert on his Telegram channel and published 11 theft addresses linked to it.
- The attacker withdrew more than $106 million in two stablecoins, USDC and USDT, from multiple exchange accounts tied to the entity.
- Part of the haul has already moved into Monero (XMR), a privacy coin that is far harder to trace on-chain.
- The entity’s name and the attack method remain undisclosed, and no one has independently confirmed the losses so far.
The attacker moved within 24 hours
The alert describes an operator who wasted no time. Over the 24 hours after the withdrawals, the illicit actor pushed the stolen stablecoins through four kinds of moves, according to ZachXBT:
- Swapping USDC for ETH at an aggressive pace.
- Sending funds to instant exchange services, including WellWallet and Kyrrex.
- Converting funds into XMR through Wagyu.
- Bridging assets across multiple blockchains.
The first step carries the most weight. Circle, the issuer of USDC, can blacklist addresses that hold its token, and Tether can do the same with USDT. ETH has no issuer that can freeze it, so every dollar swapped out of USDC leaves Circle’s reach.
Wagyu.xyz describes itself as a cross-chain swap and bridge platform that offers native Monero without identity checks. In August, the operator said more than $700 million in XMR volume had passed through its Hyperliquid route since January 2026. It also launched a public API that screens deposits before a swap executes. Whether that screening flagged any of these deposits is not yet known.
Stablecoin issuers face another freeze test
The alert lands days after Binance lost an estimated $6.3 billion in a hack TRM Labs and Chainalysis tied to North Korea’s TraderTraitor group. That theft now tops the list of the most expensive crypto exchange hacks on record. In that case, Circle CEO Jeremy Allaire confirmed freezing more than 800 million USDC in coordination with law enforcement. Binance said it and its partners had frozen about $3 billion. Nothing in ZachXBT’s alert ties the two incidents together.
Timing decides whether freezes work. ZachXBT accused Circle in April of failing to freeze or blacklist about $420 million in illicit USDC across 15 cases since 2022. In several of those cases, he said, stolen USDC sat in theft addresses for hours before anyone acted. The gap between how fast the two issuers respond has shaped the wider USD Coin vs Tether debate among compliance teams.
This attacker’s pattern reads as an effort to get ahead of that window. Converting USDC first, then routing through instant swaps and a Monero bridge, leaves fewer points where an issuer could step in.
Several basics are still missing. Who is the entity? Which exchanges held the accounts, and how did the attacker get access to them? Has Tether frozen any USDT still sitting in the flagged addresses? Did WellWallet, Kyrrex, or Wagyu hold or reject any of the incoming deposits? The alert also gave no split between the USDC and USDT amounts.
The Bottom Line
Compliance teams at exchanges and swap services can screen incoming deposits against the 11 published addresses. All 11 use the 0x format shared by Ethereum and other EVM chains, so one list covers those networks. The list opens with 0xADd95cD98E0288ba69785E3151E1db86adF8Dd58 and closes with 0xd010cba790a6ab0048da18f2fbe8e3faf463a16a. Entities that keep large balances on centralized exchanges may also want to review withdrawal allowlists and API key permissions.
Recovery now depends on what form the money takes. Any USDT left in the flagged addresses stays within Tether’s freeze powers, which it used in its $344 million USDT freeze earlier this year. Funds already converted into Monero sit outside any issuer’s control, and tracing them gets much harder with every hop.
