Mystery $106 Million Crypto Theft Hits EU Entity Days After Binance Hack
An unnamed European Union entity lost over $106 million from multiple centralized exchange accounts on November 1, just days after the record-breaking $6.4 billion Binance hack.
The funds were withdrawn as USDC and USDT stablecoins by what investigator ZachXBT called an "illicit actor." In the 24 hours following the theft, the attacker moved aggressively to cover their tracks, swapping stablecoins for ETH, using instant exchange services like WellWallet and Kyrrex, converting some to the privacy coin Monero via Wagyu, and bridging assets across multiple blockchains.
ZachXBT published 11 Ethereum addresses linked to the theft but didn't name the victim. The investigator said he could state "with a high degree of confidence" that the culprit isn't North Korea's Lazarus Group, citing multiple laundering indicators that set this theft apart from the Binance hack.
Stablecoin freeze response
The use of USDC and USDT is significant because the companies behind these stablecoins can freeze them. In the Binance case, Tether froze stolen USDT on Ethereum in just 37 minutes, while Circle froze all $823 million in stolen USDC, helping lock up about 44% of the stolen funds, according to blockchain analytics firm Elliptic.
North Korea's launderers have since spread the remaining funds across about 12,000 wallets. It's unclear whether any funds in the EU case have been frozen.
Unprecedented week for crypto
This incident adds to an already unprecedented week for crypto security. Beyond the record-breaking Binance hack, Brazilian exchange Mercado Bitcoin reported halting withdrawals after a $40 million hack of its own on the same day. Similarly, BTCPay Server told merchants to switch off their servers amid reports of hot wallet attacks.
Related
