--- title: "ZachXBT Warns of $106 Million Suspected Theft From EU Entity" date: 2026-11-02 author: "Kathleen Kinder" featured_image: "https://coinlaw.io/wp-content/uploads/2026/11/zachxbt-eu-entity-crypto-loss.jpg" categories: - name: "Cryptocurrency" url: "/crypto.md" tags: - name: "News" url: "/tag/news.md" --- # ZachXBT Warns of $106 Million Suspected Theft From EU Entity ZachXBT said November 2 that an unnamed EU-based entity is suspected of losing more than $106 million from centralized exchange accounts on November 1. The suspected attacker pulled the funds out as USDC and USDT, the on-chain investigator said. ## At a Glance - ZachXBT flagged the suspected theft in a community alert on his Telegram channel and published 11 theft addresses linked to it. - The attacker withdrew more than $106 million in two stablecoins, USDC and USDT, from multiple exchange accounts tied to the entity. - Part of the haul has already moved into Monero (XMR), a privacy coin that is far harder to trace on-chain. - The entity’s name and the attack method remain undisclosed, and no one has independently confirmed the losses so far. ## The attacker moved within 24 hours The alert describes an operator who wasted no time. Over the 24 hours after the withdrawals, the illicit actor pushed the stolen stablecoins through four kinds of moves, according to ZachXBT: - **Swapping USDC for ETH at an aggressive pace**. - **Sending funds to instant exchange services, including WellWallet and Kyrrex**. - **Converting funds into XMR through Wagyu**. - **Bridging assets across multiple blockchains**. The first step carries the most weight. **Circle**, the issuer of [USDC](https://coinlaw.io/usd-coin-vs-tether-statistics/), can blacklist addresses that hold its token, and Tether can do the same with USDT. ETH has no issuer that can freeze it, so every dollar swapped out of USDC leaves Circle’s reach. **Wagyu.xyz** describes itself as a cross-chain swap and bridge platform that offers native Monero without identity checks. In August, the operator said more than **$700 million** in XMR volume had passed through its Hyperliquid route since January 2026. It also launched a public API that screens deposits before a swap executes. Whether that screening flagged any of these deposits is not yet known. ![Zachxbt Eu Entity Loss](https://coinlaw.io/wp-content/uploads/2026/11/zachxbt-eu-entity-loss.jpg)**Credits – ZachXBT on Telegram** ## Stablecoin issuers face another freeze test The alert lands days after Binance lost an estimated **$6.3 billion in a hack TRM Labs and Chainalysis tied to North Korea’s TraderTraitor group**. That theft now tops the list of the [most expensive crypto exchange hacks](https://coinlaw.io/most-expensive-crypto-exchange-hacks/) on record. In that case, Circle CEO **Jeremy Allaire** confirmed freezing more than **800 million USDC** in coordination with law enforcement. Binance said it and its partners had frozen about $3 billion. Nothing in ZachXBT’s alert ties the two incidents together. Timing decides whether freezes work. [ZachXBT accused Circle in April](https://coinlaw.io/zachxbt-circle-usdc-freeze-delay-crypto-hacks/) of failing to freeze or blacklist about **$420 million** in illicit USDC across 15 cases since 2022. In several of those cases, he said, stolen USDC sat in theft addresses for hours before anyone acted. The gap between how fast the two issuers respond has shaped the wider USD Coin vs Tether debate among compliance teams. This attacker’s pattern reads as an effort to get ahead of that window. Converting USDC first, then routing through instant swaps and a Monero bridge, leaves fewer points where an issuer could step in. Several basics are still missing. **Who is the entity?** **Which exchanges held the accounts, and how did the attacker get access to them?** **Has Tether frozen any USDT still sitting in the flagged addresses? Did WellWallet, Kyrrex, or Wagyu hold or reject any of the incoming deposits?** The alert also gave no split between the USDC and USDT amounts. ## The Bottom Line Compliance teams at exchanges and swap services can screen incoming deposits against the 11 published addresses. All 11 use the 0x format shared by Ethereum and other EVM chains, so one list covers those networks. The list opens with **0xADd95cD98E0288ba69785E3151E1db86adF8Dd58** and closes with **0xd010cba790a6ab0048da18f2fbe8e3faf463a16a**. Entities that keep large balances on centralized exchanges may also want to review withdrawal allowlists and API key permissions. Recovery now depends on what form the money takes. Any USDT left in the flagged addresses stays within Tether’s freeze powers, which it used in its [$344 million USDT freeze](https://coinlaw.io/tether-freezes-344m-usdt-us-crackdown/) earlier this year. Funds already converted into Monero sit outside any issuer’s control, and tracing them gets much harder with every hop. Definition of EVM. Link to full glossary entry follows the description.**EVM**The Ethereum Virtual Machine is the runtime environment that executes smart-contract bytecode across every Ethereum node, using a 256-bit stack architecture and [gas](https://coinlaw.io/glossary/gas-fee/)-metered computation. [Read more about EVM](https://coinlaw.io/glossary/evm/) Definition of Cross-Chain. Link to full glossary entry follows the description.**Cross-Chain**Cross-chain is the ability to move data or assets between separate blockchains via bridges, messaging protocols, or interoperability networks. [Read more about Cross-Chain](https://coinlaw.io/glossary/cross-chain/)