Another Nine-Figure Theft Hits Crypto as Security Crisis Deepens

The cryptocurrency ecosystem is grappling with yet another massive security breach, with an unidentified entity in the European Union losing more than $106 million over the weekend. The staggering nine-figure theft comes hot on the heels of the largest heist in the history of the digital asset industry, compounding what has rapidly evolved into an unprecedented week of chaos, vulnerabilities, and multi-million-dollar exploits across global platforms.

According to prominent pseudonymous onchain investigator ZachXBT, the latest incident took place on Sunday. In a detailed post shared to his public Telegram channel on Monday, the investigator revealed that the victim—an unnamed organization or individual based within the European Union—saw funds drained from several accounts held across various centralized exchanges. The stolen capital was swiftly converted and withdrawn primarily in the form of prominent stablecoins, specifically USDC and USDT, by an entity he characterized as an "illicit actor."

The unfolding situation highlights the persistent structural vulnerabilities that continue to plague centralized platforms and large-scale crypto holders, even as blockchain surveillance tools become increasingly sophisticated. In the critical 24 hours immediately following the breach, the perpetrator moved aggressively and systematically to obscure the trail of stolen assets, employing a complex web of decentralized laundering techniques designed to bypass compliance filters.

ZachXBT noted that the attacker wasted no time swapping the stolen USDC into Ethereum (ETH), routing funds through instant cryptocurrency exchange services such as WellWallet and Kyrrex, and converting substantial portions into Monero—a well-known privacy coin—via Wagyu. Furthermore, the bad actor executed cross-chain bridges to disperse the assets across multiple distinct blockchains, complicating tracking efforts for forensic analysts and law enforcement agencies alike. To assist the broader community and security researchers, ZachXBT published 11 specific Ethereum addresses directly tied to the illicit transfers.

The mechanics of the laundering process underscore the deliberate strategies employed by modern cybercriminals to evade detection. Instant exchanges allow users to swap digital assets rapidly with minimal identity verification requirements, creating a convenient loophole for bad actors looking to shed easily traceable tokens. Meanwhile, privacy-centric cryptocurrencies like Monero obfuscate senders, receivers, and transaction amounts entirely, making them a favored instrument for laundering stolen crypto funds.

The decision to swap out of USDC and USDT was also strategically significant. Both stablecoins are issued by centralized entities—Circle and Tether, respectively—that possess the technical capability to freeze tokens associated with illicit activity. By rapidly converting these stablecoins into native assets like Ethereum and privacy coins, the attacker sought to preempt any swift freezing actions by the issuers.

Despite the sophisticated laundering playbook, ZachXBT stated that the culprit remains unidentified. However, the onchain investigator noted with a high degree of confidence that the attack was not orchestrated by the Lazarus Group, the umbrella name frequently attributed to North Korea’s state-backed hacking apparatus. This assessment was based on multiple laundering indicators and behavioral patterns that diverged from historical tactics used by North Korean threat actors. ZachXBT also chose to withhold the identity of the victim organization.

This distinction separates the European Union incident from the record-setting $6.4 billion Binance hack that occurred just days prior. In that massive breach, the U.S. Federal Bureau of Investigation formally attributed the attack to TraderTraitor, a notorious North Korean hacking group. The response to the Binance hack showcased the reactive capabilities of modern stablecoin issuers: Tether successfully froze stolen USDT on the Ethereum network within a remarkable 37 minutes, while Circle froze the entirety of the $823 million in stolen USDC. According to blockchain analytics firm Elliptic, these coordinated interventions successfully locked up roughly 44% of the total loot before it could be fully laundered.

Despite those rapid interventions, North Korean laundering syndicates quickly adapted, spreading the remaining fraction of the Binance funds across approximately 12,000 distinct wallets to dilute tracking efforts. As of now, it remains unclear whether any funds linked to the European Union account thefts have been successfully frozen by exchanges or issuers.

The timing of the $106 million breach reinforces an exceptionally turbulent period for digital asset security worldwide. Beyond the historic Binance exploit, the Brazilian cryptocurrency exchange Mercado Bitcoin announced that it was forced to halt user withdrawals following a $40 million hack targeting its own systems. In a separate development that same day, BTCPay Server issued an urgent security warning advising merchants worldwide to immediately switch off their servers amid mounting reports of targeted hot wallet attacks.

As investigators continue to analyze the onchain footprints of these successive breaches, the events serve as a stark reminder of the persistent and evolving threats facing institutions, exchanges, and individual holders navigating the digital asset economy.