Crypto Theft: Suspected $106M Loss at EU Entity

On November 2, on-chain investigator ZachXBT reported a suspected crypto theft of more than $106 million from accounts at several centralized exchanges. The suspected withdrawals took place on November 1. The victim is an unidentified EU entity, and neither the alleged victim nor an exchange had publicly confirmed the incident as of BeInCrypto’s report that day.

What we know about the crypto theft

ZachXBT said the entity was suspected of losing funds from multiple centralized-exchange accounts and published 11 suspected theft addresses. BeInCrypto reported that the suspected withdrawals involved USDC and USDT, stablecoins designed to maintain a value of $1. Its review found roughly $80 million in USDC arriving at 11 wallets over 11 hours. The broader suspected-loss estimate of more than $106 million also includes USDT.

Bitquery separately tracked $108.80 million in USDC withdrawals from Kraken, Crypto.com and OKX to 15 wallets between November 1 and 2. This is a trace of USDC movements, not a revised total for the overall suspected loss. The different wallet counts and amounts reflect separate analyses, not a confirmed accounting of everything taken.

At 13:47 UTC on November 2, Bitquery estimated that about $78.27 million remained in addresses it attributed to the suspected actor, mostly as ETH. It also identified around $3.74 million in USDC still in wallets, which Circle could freeze. These are investigator estimates, not confirmation from the exchanges or alleged victim. Bitquery’s transaction analysis provides a wallet-by-wallet account.

How the crypto theft funds reportedly moved

ZachXBT said the suspected attacker swapped USDC for ETH, used instant-exchange services including WellWallet and Kyrrex, and converted some assets to Monero through Wagyu. The investigator also described transfers between blockchains. Monero obscures transaction details, while stablecoin issuers can freeze their tokens.

Bitquery said 11 of the 15 wallets receiving its traced withdrawals had previously received payments from the same exchanges. The pattern could indicate access to the victim’s wallet keys as well as exchange logins, but it does not establish how the compromise happened.

What is still unclear

The entity and the method of access have not been publicly identified. BeInCrypto reported on November 2 that neither the alleged victim nor an exchange had confirmed the theft. The supplied reporting does not establish how the accounts were accessed.

BeInCrypto also reported that at least five flagged wallets had received smaller payments from the same source months earlier. That history raises questions, but does not establish when or how any compromise occurred. ZachXBT said he had high confidence the suspected actor was not Lazarus Group, which is associated with North Korean crypto thefts.

The assessment differs from attribution in the separate Binance case. According to the Associated Press, the FBI attributed the October 29 Binance theft to North Korea-linked TraderTraitor. Similar timing does not establish a connection between the incidents.

How markets and analysts reacted

The suspected EU crypto theft came amid scrutiny of exchange security after the Binance incident. Binance said its hot wallets were compromised around 20:05 UTC on October 29, with approximately $6.3 billion in token assets lost. In an October 30 update, the exchange said it would cover the loss and reported about $3 billion frozen on-chain. Binance’s incident update describes its response.

Reuters reported on November 2 that Binance customers had withdrawn a net $4.72 billion since withdrawals resumed, about 3% of the platform’s assets. Analysts cited by Reuters viewed the outflows as relatively modest and noted Binance’s commitment to cover losses. That response concerns Binance, not the unidentified EU entity.

Market data showed declines, but does not establish that either theft caused them. At 23:13 UTC on November 2, CoinGecko put Bitcoin at $76,733, down 1.74% over 24 hours, and Ether at $2,253.21, down 0.77%. The Crypto Fear & Greed Index was 37, classified as Fear, on November 2.

What it means for investors

The case highlights that exchange account access and control of wallet keys may both be relevant to a suspected theft. Bitquery said the payment history could indicate access to the victim’s wallet keys as well as exchange logins, but cautioned that it did not establish how the accounts were compromised. The reported transfers also show that suspected funds moved from stablecoins into ETH and, in some cases, Monero. Bitquery said about $3.74 million remained in USDC that Circle could freeze; its report did not say those funds had been frozen or recovered.

There is no public evidence that this incident exposed all EU exchange customers or involved a wider platform breach. The method of access and the identity of the victim remain unknown.

What to watch next in the crypto theft investigation

Useful developments would include confirmation from the victim or named exchanges, details of how access was obtained, and updates on whether traced assets are frozen or recovered. Further wallet movements could refine the on-chain picture, but would not by themselves identify the attacker or prove the initial entry point.

Bottom line

Investigators have traced substantial stablecoin movements linked to a suspected loss of more than $106 million, but the EU entity and attack method remain unknown. The crypto theft is separate from the Binance breach, and no connection between the events has been substantiated.

Sources

• $106M Crypto Hack: $108.8M Traced, $78.3M Still on Ethereum (www.bitquery.io)
• Security Incident Update #2 (2026-10-30) (www.binance.com)
• Mystery $106 Million Crypto Theft Hits EU Entity Days After Binance Hack (Decrypt)

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.