EU Entity's USDC and USDT Drain Tops $106 Million, ZachXBT Says

Stablecoins Out of Exchange Accounts

More than $106 million left the centralized exchange accounts of an unnamed entity inside the European Union on November 1, and the on-chain record of the exit is now public. On-chain investigator ZachXBT published the money trail in a Telegram investigation post on the evening of November 2, writing that the suspected stolen funds were withdrawn as the stablecoins USDC and USDT from multiple centralized exchange accounts. Neither the victim nor any third party has publicly confirmed the amount or the method, and the identity of the European entity remains undisclosed. What the trace shows is a deliberate stripping of traceability in stages. The actors first converted USDC into Ether, the deepest and most liquid pairing available to them at swap desks. They then fed the Ether through instant exchange services with light identity requirements, including WellWallet and Kyrrex, services built to turn one asset into another within minutes and without a full compliance file. The next hop converted the proceeds into Monero (XMR), a privacy-focused layer 1 blockchain where transfer amounts and counterparties are obscured by design. The final stage bridged value across several public chains, an omnichain pattern that snaps the trace chain at every jump and forces any investigator to re-anchor from zero. ZachXBT placed the heaviest movement inside a window of roughly 24 hours and described the actors as moving with speed. Exiting in stablecoins also fixes the value of the theft at the moment of withdrawal, which is why the $106 million figure can be stated precisely while the victim stays silent. Funds pulled from several accounts rather than one wallet points to a coordinated compromise of credentials rather than a single key leak, though the entry vector is not yet documented. He likewise published multiple addresses tied to the theft so that exchanges and community watchers can cross-reference incoming deposits against their own books.

The Freeze Window After Conversion

ZachXBT added a second judgment: judging by several laundering characteristics, he is highly confident the actor behind the suspected theft is not Lazarus Group, the North Korean cluster behind a long run of exchange hacks, and the perpetrator's real identity stays open. The unresolved part of the case is operational. If the funds truly left several centralized exchange accounts, the breach sits at the account layer: logins, API keys, withdrawal whitelists and abnormal-withdrawal interception all failed to fire before the stablecoins could be flagged. That ordering matters because both assets in question still answer to their issuers. USDC and USDT carry issuer freeze mechanisms, and an issuer or a venue can intervene only while the value remains in a form those parties can touch. Freezing works at the token level, meaning an issuer can blacklist an address holding the asset; the same power does not follow the funds into Ether or Monero. Every conversion burns the option: once the money is Ether, once it clears an instant swap, once it lands in Monero, the window closes. For exchanges, the episode argues for faster address blacklist sharing and tighter KYT alerting, the real-time screening that flags deposits against blacklisted addresses, across venues; for institutions holding large balances on centralized platforms, it renews the case for multi-factor authentication, withdrawal cooldowns and custody split across providers. The precise split between the two stablecoins in the stolen total has not been published. The event also lands while USDC's own issuer is mid-renovation: Circle has scheduled a December 1 pause for CCTP V1, its legacy USDC bridge, COINOTAG's preview of Circle (CRCL) Q3 results puts EPS at $0.40 alongside USDC growth, and a recent seven-day reading had USDC circulation down 800 million. Issuer tooling is being rebuilt at the same moment thieves are demonstrating how fast it can be routed around.

An Unconfirmed Loss, an Unnamed Actor

The evidentiary base here is the chain itself: addresses published, hop pattern documented, total stated, and still no confirmation from the entity that supposedly lost the money. Our reading is that the entry point was most plausibly account-level rather than a protocol breach, and the remediation that follows is unglamorous: credential rotation, whitelist audits and pre-flagged freezing that executes in minutes, because conversion to Ether and Monero closes the issuer's reach fast. Account theft at centralized venues also sits outside most DeFi insurance coverage, which is written around on-chain protocol exploits rather than compromised credentials. For now the case stays open: the actor is unidentified, the trail runs through Monero and across bridges, and neither the victim nor the loss figure has been independently confirmed.