Blockchain investigator ZachXBT said on November 2 that an unnamed entity in the European Union lost more than $106 million in stablecoins from its accounts at several crypto exchanges the day before. Part of the money was swapped into ether and then Monero, which is much harder to trace. The victim, the exchanges and how the accounts were opened haven't been named.

Key facts

  • Who: An unnamed EU entity, per investigator ZachXBT; he says it is likely not North Korea's Lazarus Group
  • What: Accounts at several centralized exchanges compromised; USDC and USDT withdrawn, then moved through swap services
  • How much: More than $106 million, a suspected figure no victim or exchange has confirmed
  • When: Theft on November 1, 2026; flagged November 2
  • Source: CoinDesk, reporting ZachXBT's alert

On Sunday, November 1, more than $106 million in stablecoins left accounts that one organization in the European Union held at several crypto exchanges. Blockchain investigator ZachXBT flagged the suspected theft the next day, CoinDesk reported. He didn't name the victim or the exchanges. Neither has confirmed a loss.

The money came out as USDC and USDT, two dollar-pegged stablecoins. ZachXBT published 11 addresses he ties to the theft.

Where the money went

The thief swapped the USDC for ether, then sent funds to instant swap services, including WellWallet and Kyrrex, Unchained reported. Part of it was turned into Monero through a swap service called Wagyu, and some was bridged to other blockchains.

That order matters. The companies behind USDC and USDT can freeze their coins at an address, and they did so after the Binance hack. No company can freeze ether or Monero. Monero is also built to hide who sent what, so once money gets there, tracing it is much harder.

ZachXBT said he has "a high degree of confidence" that the attacker isn't Lazarus Group, the North Korean hackers the FBI blamed for the Binance theft, BeInCrypto reported.

What isn't known

How the attacker got into the accounts hasn't been reported. It could have been stolen passwords, stolen API keys (the codes that let software trade or withdraw for an account), or someone on the inside. One site named a French bank and a higher figure, but no other outlet has confirmed that, so we aren't repeating it.

What holds for any exchange account

  • Turn on a withdrawal allowlist. Most big exchanges let you lock withdrawals to addresses you've saved, with a waiting period for new ones.
  • Give API keys trade-only rights. A key that can't withdraw can't empty the account.
  • Use an authenticator app or security key, not text-message codes.

After big thefts, fake "recovery" offers follow. Here's how recovery scams work. For another exchange theft this week, see the Mercado Bitcoin hack.

Sources: CoinDesk, EU entity suspected of losing $106 million from crypto exchange accounts, ZachXBT says (November 2, 2026), Unchained, $106 million suspected stolen from EU entity as funds flow into Monero: ZachXBT (November 2026), BeInCrypto, $106 million crypto theft hits EU entity with multiple exchange accounts (November 2026).