An unnamed entity based in the European Union is suspected of suffering losses exceeding $106 million after funds were withdrawn from accounts held across several centralized cryptocurrency exchanges on Nov. 1, according to on-chain investigator ZachXBT. The investigator disclosed the suspected theft in a community alert on Nov. 2, stating that the assets left the accounts primarily as USD Coin and Tether before being moved through a series of swaps, instant exchange services, privacy coin conversions and cross-chain transfers.

ZachXBT did not identify the victim or the specific exchanges involved. The term “entity” can refer to a range of organizations, including companies, trading firms or investment funds. No confirmation has come from any exchange or the alleged victim, and the losses have not been independently verified beyond the on-chain trails described by the investigator.

How the Funds Moved

The suspected attacker withdrew the funds in USDC and USDT. Over the following hours, the actor aggressively converted large amounts of USDC into ether. One wallet associated with the activity, labeled 0x9EcA in tracking reports, spent roughly $63 million in USDC to acquire approximately 27,553 ETH at an average price near $2,286. The purchases initially appeared to some market watchers as large-scale buying by a whale before the connection to the suspected theft was established.

From there, the ether was rapidly distributed. Tracking showed transfers of more than 15,000 ETH to one secondary wallet and more than 12,000 ETH to another in multiple batches within hours of the initial purchases. Portions of those holdings were later moved onward, including test amounts and larger transfers directed toward cross-chain services and bridges. Some residual ether remained in the associated addresses at the time of the reports.

Parallel paths involved instant-exchange platforms. ZachXBT specifically named WellWallet and Kyrrex among the services used to move funds. A portion of the assets was converted into the privacy-focused cryptocurrency Monero through a service identified as Wagyu. Bridges were also employed to shift value across multiple blockchain networks. The investigator published a list of 11 addresses linked to the activity and encouraged monitoring of the related flows.

Laundering Pattern and Current Holdings

The sequence of converting stablecoins into ether shortly after withdrawal is a common early step in theft cases because ether cannot be frozen by an issuer in the way USDC or USDT can. Converting further into Monero adds another layer of difficulty for tracing. The overall pattern, according to ZachXBT, did not match the typical indicators associated with the North Korea-linked Lazarus Group.

As of the latest tracking cited in the reports, significant portions of the converted ether remained in wallets connected to the activity, while other amounts had already moved through bridges, instant services or secondary addresses. Some residual stablecoin balances were still visible on-chain at the time of the disclosures.

The absence of any public statement from the affected entity or the exchanges has left the precise circumstances of the account access unexplained. Investigators noted that the funds originated from accounts that had previously interacted with the same exchange withdrawal destinations, consistent with a compromise of the customer’s side rather than a direct breach of the platforms themselves.

Market Context of the ETH Purchases

The large overnight accumulation of ether by the primary wallet temporarily registered as bullish whale activity before the link to the suspected theft became clear. Ether was trading near the average purchase price of the converted funds around the time of the reports. Subsequent distribution of the holdings across multiple wallets and bridges means portions of that supply could re-enter circulation through secondary sales on other networks.

No further official statements or confirmed identifications of the victim or perpetrator had emerged by the time of the initial disclosures. Community monitoring of the listed addresses continues as the funds remain partially on-chain and partially dispersed.