On-chain investigator ZachXBT reported that an unknown actor may have stolen more than $133 million from several accounts on centralized crypto exchanges on Nov. 1, 2026. The scale of the alleged theft and subsequent laundering activity matters because the victim may have been a European financial institution, although ZachXBT provided no evidence identifying the organization.

ZachXBT initially estimated the losses at more than $106 million. He later identified additional withdrawals from centralized exchanges totaling more than $27 million, raising his overall estimate to more than $133 million. Some of the additional transactions occurred after his first report.

According to ZachXBT’s observations, the attacker converted USDC and USDT stablecoins into Ethereum, or ETH. Over a 24-hour period, the attacker actively swapped USDC for ETH and transferred assets to instant exchange services, including WellWallet and Kyrrex.

The funds were then converted into Monero, or XMR, through the Wagyu service and moved between blockchains using cross-chain bridges.

ZachXBT has not identified the attacker. Based on the money-laundering indicators he detected, however, he said he could rule out the North Korean hacking group Lazarus Group with a high degree of confidence.

ZachXBT suggests a Western European financial institution may be the victim

ZachXBT said the victim may have been a major financial institution in Western Europe that was trying to conceal the incident. He did not name a specific organization or provide evidence supporting that hypothesis.

He also said the lack of timely disclosure may have allowed the attacker to launder more than $30 million. In his view, European Union law enforcement agencies could have frozen those funds if they had received the information in time.

ZachXBT previously infiltrated a Chinese syndicate and traced more than $1 billion in funds linked to Lazarus Group.

Source: Incrypted