Blockchain investigators continue to monitor two significant crypto security incidents: the suspected theft of more than $106 million from an unnamed European Union entity, and the drain of roughly $786,000 from King, one of the aging Solana trading bots. ZachXBT and the on-chain analytics account Onchain Lens are among those tracking the cases. The larger incident remains open, with the victim, the exchanges involved, and the attacker all still unidentified.

EU Entity Suspected of Losing Over $106M in Crypto

Blockchain investigator ZachXBT said an unnamed EU entity is suspected of losing more than $106 million in digital assets from accounts held at several centralized crypto exchanges on Nov. 1. The suspected stolen funds were initially siphoned off in the form of USDC and USDT.

ZachXBT released 11 addresses associated with the activity, but did not disclose the identity of any victims or explain how the exchange accounts had been opened. Publicly listing wallet addresses is a standard early step in on-chain investigations: it gives exchanges, analytics firms, and stablecoin issuers a concrete set of identifiers to monitor or act on while funds are still traceable.

The suspected attacker then moved quickly to obscure the trail. Within the following 24 hours, USDC was swapped into ether, and funds were pushed through instant exchange platforms such as WellWallet and Kyrrex. Using Wagyu, a portion of the assets was converted into the privacy coin Monero, while other assets were moved across several blockchain networks.

ZachXBT Rules Out Lazarus Group

The laundering activity does not appear to follow the patterns typically associated with the North Korea-linked Lazarus Group, ZachXBT further said. Although whoever carried out the actual theft has not been determined, the investigator said he had a “high degree of confidence” that it was not the work of Lazarus.

The assessment is significant, as it follows a wave of recent large-scale cryptocurrency breaches that has brought North Korean cyber gangs back into the spotlight. There is, however, no evidence at this time linking the EU incident to those operations. Early-stage attribution in cryptocurrency cases typically rests on such behavioral signatures rather than on a confirmed claim of responsibility, which is why conclusions can remain provisional while tracing continues.

Stolen Funds Move Beyond Freezable Stablecoins

The transition from freezable stablecoins into ETH and XMR could hinder recovery efforts. Issuers of USDC and USDT are able to freeze tokens on designated addresses, whereas assets like ether have no centralized issuer with comparable capabilities. Monero poses yet another challenge, as the privacy features of the network strip identifying details away from transactions.

The speed with which instant exchanges and cross-chain bridges were used also makes the money trail more complex, requiring investigators to trace activity through various networks and services. A concrete development to watch is whether the issuers of USDC and USDT freeze any of the 11 published addresses — an issuer-level action that has been used during past large-scale thefts.

Neither the EU firm in question nor the exchanges involved have confirmed the loss of funds.

Solana MEV Bot King Loses Another $786K

A separate incident struck King, one of the older automated arbitrage bots operating on the Solana network. According to Onchain Lens, the bot was drained of approximately $786,000, comprising roughly 4,260 WSOL, 191 SOL, and $366,000 worth of stablecoins. Prior to the incident, King was reported to have generated about $7.2 million in lifetime profits. Bots in this category operate by continuously scanning venues for pricing inefficiencies, and their working capital generally sits in online wallets that sign transactions automatically around the clock.

SOLANA MEV BOT KING DRAINED OF $786K 💀

King, one of Solana’s oldest arbitrage bots with $7.2M in lifetime PnL, was drained of ~$786K, including 4.26K $WSOL, 191 $SOL and $366K in stablecoins.

Drainers: BHRayETPjvgg3BCr9H82V1D6NRwxu5v44JAaVuaod3jU
Forwarder: Ddmy5oM8xtTs1EBC6eF2SZwQfBreewQpFgtUDm51Hkqj
Victim: 7dGrdJRYtsNR8UYxZ3TnifXGjGc9eRYLq9sELwYpuuUu

— Onchain Lens (@OnchainLens) November 2, 2026

Onchain Lens also located the suspected drainer wallet, the forwarder wallet, and the victim wallet’s address. It has not yet been revealed what specific method was used to access the monitoring account, or whether the wallet was compromised through that channel or by another means. With the drainer, forwarder, and victim addresses now public, any further movement of the drained funds can be followed on-chain, even as the method of entry remains unconfirmed.

Both cases remain unresolved. In the exchange breach, the affected firm, the venues involved, and the perpetrators have yet to be publicly identified. In the King drain, the exact method of compromise has still not been established.

Based on reporting by Crypto Ninjas.