ZachXBT Traces $106M Stolen From EU Organization Through Crypto Into Monero

USDC to Ethereum, Then Monero

More than $106 million in stolen digital assets is now on a path that runs from centralized exchange custody through Ethereum and ends in Monero (XMR). On-chain investigator ZachXBT reported the case on Nov 2: an unnamed organization inside the European Union had the funds improperly withdrawn from accounts it held at several centralized exchanges one day earlier, on Nov 1, in the form of the stablecoins USDC and USDT. Neither the victim nor any platform involved has been named, and no recoveries have been announced. The first documented hop converted USDC into Ethereum (ETH), meaning the stablecoins were swapped almost immediately after leaving custody, and pushed the proceeds through instant exchange services, with WellWallet and Kyrrex among the platforms named in the report. From there the money kept moving: it crossed between multiple chains, and a cross-chain service called Wagyu was used to turn part of the haul into Monero (XMR). The Ethereum leg is the only stretch of the route that remains fully readable, since every transfer on it is timestamped and addressable on the public record. Monero exists for the opposite purpose: its blockchain conceals the sender, the recipient and the amount of every transfer, which is why stolen funds are so often routed into it once the trail needs to disappear. That transparency gap is why this case reads differently from a typical exchange breach, as our Etherscan review of on-chain tracing shows. The choice of instant swap services matters at the front end of the run, because these platforms exchange assets quickly without the withdrawal holds and identity checks a major exchange applies to a fresh eight-figure request, and splitting a large balance into many hops costs little more than a routine gas fee each time.

ZachXBT put the probability that the Lazarus Group, the North Korea-linked hacking cluster, carried out the theft at “extremely low”, reading the laundering method itself rather than the victim's profile. The call lands in a week crowded with attribution questions. On Oct 29, Binance suffered an outflow reported at roughly $6.3 billion, and the FBI issued an official statement attributing that attack to North Korea, which is why the distinction between the two cases carries weight: a state-linked cluster typically works stolen funds slowly through instruments it can cash out over time. Attacks on crypto platforms followed one another through the same stretch. Mercado Bitcoin, a major Brazilian exchange, suspended deposits and withdrawals on Nov 2 after detecting a security incident in one of its systems, saying in its own announcement that customers suffered no losses and no data leaked; blockchain security firm Hypernative estimated that more than $40 million was drained from wallets connected to the company. BTCPay Server, the free open-source Bitcoin payment processor, urged operators to stop their payment servers on Nov 1 after reports of unauthorized withdrawals from the hot wallets of self-hosted instances, and the project is self-hosted by design, so exposure varied by operator. The team established that the attacks targeted servers running versions before 2.4.1, released on July 23, 2026, and told anyone still on an older build to move every remaining hot-wallet balance elsewhere and migrate to a separate server with a fresh wallet. Hot wallets, whether an exchange account, a processor's checkout or an operator's node, are the common thread across the week's incidents.

Custodial Accounts, Not Contracts

This was not a smart contract failure. The funds sat in custodial exchange accounts and left through withdrawals, and the laundering design, not a code exploit, is what grounded the decision to rule out Lazarus. The same transparency that lets anyone watch a whale put $62.97 million into 27,553 ETH in five hours, or flag a Kanye West-linked wallet's 2,074 ETH withdrawal from Binance, is what let the investigator read the Ethereum network leg of this route hop by hop. The Wagyu conversion into Monero (XMR) is where that visibility stops, and the unreadable leg is the point of the exercise. As of the Nov 2 report, the last documented position of the stolen funds was the cross-chain conversion through Wagyu into Monero, with nothing on record beyond it.