A November 2 investigation by blockchain analytics firm Bitquery traced roughly $108.8 million in USDC out of accounts at three cryptocurrency exchanges, following funds that on-chain investigator ZachXBT flagged as a suspected theft from an EU-based entity, as relayed in a post by the X account Officer's Notes. The Bitquery investigation found that 11 of the 15 receiving wallets had received payouts from the same exchanges before November 1, that $62.98 million in stablecoins was converted into 27,553 ETH, and that only $3.7 million of the funds remained in freezable USDC.

Twenty-One Hours Across Three Exchanges

The first withdrawal left OKX at 12:25 UTC on November 1. Kraken followed 44 minutes later and ultimately paid out 95% of the total, with Crypto.com supplying the remainder alongside OKX. Roughly two-thirds of the money, $73.2 million, moved in the three hours to 23:00 UTC, and the final payment landed at 09:09 UTC the following morning.

One wallet received 43 Kraken withdrawals within 91 minutes, each below $50,000. Bitquery interprets the pattern as the thief working around a limit on individual withdrawals, a standard safeguard on exchange accounts. If that reading is correct, the cap changed the shape of the outflow without reducing its size.

None of these amounts is a loss the victim has confirmed. Bitquery analyzed Ethereum only and checked the three exchanges' main wallets, so activity on other chains or through other wallets at the same exchanges could add to the count. The victim remains unnamed, though the wallets' history points to a trading or payments business that has used Kraken since May — a view Bitquery says it holds loosely.

Why the Old Wallets Point Past the Exchange Login

Eleven of the 15 receiving wallets had taken payouts from the same exchanges before November 1, and together they received 84% of the money. The oldest took its first Kraken withdrawal on May 4 and 48 more before the theft. Several of the wallets paid one another over the summer. Eight of the 15 are Trust Wallet smart accounts set up to pay network fees in USDC — so the fee comes out of the token balance rather than ETH — though Bitquery found nothing pointing to a flaw in the app itself.

That history is why Bitquery treats the wallets as the victim's own, and it explains why the exchange login alone does not account for what happened next. The USDC typically moved on to a fresh wallet within three minutes, and sending it onward required the keys to the receiving wallet. Bitquery concludes that the thief most likely held both the logins and those keys. In its reading, that points either to a break-in on the owner's devices or wallet setup, or to someone inside the victim's own team. The chain cannot tell those apart.

The ownership call remains an inference from wallet behavior, and neither the victim nor the exchanges have confirmed it. If some of those addresses belonged to an employee, contractor or counterparty, the earlier payouts would show that the entity trusted a person, not that its own keys leaked. Either way, nothing in the trace shows a breach of Kraken, Crypto.com or OKX. The withdrawals came from one customer's accounts.

Where an Allowlist Holds and Where It Gives Way

An allowlist lets an account withdraw only to addresses approved in advance. The trace splits this theft into two cases, and they test that setting differently.

The 11 familiar wallets are the case an allowlist cannot address. If they were already approved, transfers to them would pass the check, because the setting restricts the address and says nothing about who holds its keys today.

The four new wallets, which received $17.27 million, are the opposite case. The first payments from both OKX and Kraken went to addresses with no prior history. As Bitquery puts it, if the accounts used an allowlist, the thief was able to add to it; if they had none, the money could go anywhere. Whether any of these accounts had one switched on is not public.

That second route is what the exchanges' additional controls are built for:

• OKX: Alongside its allowlist feature, a separate new-address lock blocks withdrawals to a newly added recipient for 24 hours.
• Crypto.com Exchange: A 24-hour hold applies to newly whitelisted addresses, and switching the feature off takes another 24 hours to take effect.
• Kraken: The Global Settings Lock blocks new withdrawal addresses and changes to protected settings. Lifting it means waiting out a delay chosen by the user, unless they set up a Master Key beforehand — a separate credential that can override the wait.

None of these controls touches a wallet that is already on the list. A lock that slows new addresses still lets anyone with the right keys use an old one.

Swapped Out of Freezable USDC Within Hours

The withdrawn funds left as USDC, which its issuer, Circle, can freeze at any address — a power issuers have exercised in past on-chain thefts. ETH has no issuer, and DAI has no freeze function, so converting the stablecoins was the thief's first job.

Shortly before midnight UTC on November 1, a fresh wallet began selling stablecoins through UniswapX, an auction in which trading firms compete to fill orders. In about four hours it sold $62.98 million in USDC and USDT for 27,553 ETH, roughly $2,286 per coin. Another branch of the funds went into DAI. Bitquery saw no Circle freeze during the sale or at its check on Monday, and says it does not know whether anyone asked Circle to act.

At 13:47 UTC on November 2, $78.27 million still sat on Ethereum in addresses Bitquery ties to the thief, most of it beyond any issuer's reach. About $30.5 million had already left. The largest exit, $8.12 million, went to a KuCoin deposit address that Bitquery believes is the pooled account of Kyrrex, a European exchange. LI.FI, a bridge and swap router, took $4.34 million, part of it through one-time order wallets that analytics firm TRM tags as Wagyu, a service that swaps into Monero, a privacy-focused cryptocurrency whose ledger is designed to conceal senders, recipients, and amounts. FixedFloat, an instant exchange that requires no account, took $1.32 million.

Seeing the ETH on Ethereum gives the victim no way to move it back. What can still be reached depends on parties with power over their slice: Circle over the remaining USDC, KuCoin and Kyrrex over the account the deposit credited, and the instant exchanges over who placed the orders.

What Would Settle the Access Question

Kraken, which paid 178 of the withdrawals, can confirm who owns the account and what happened inside it. Three records would test Bitquery's theory: when the four new addresses were added and whether a lock or delay applied at the time; whether the withdrawals came through a logged-in session or through API keys with withdrawal rights, credentials that let software act on an account without a person signing in; and whether any security setting changed in the hours before 12:25 UTC on November 1.

If those logs show the new addresses went through because a waiting period was switched off, the lesson moves toward account settings. If the settings were intact and the money still moved through old wallets, the wallet-key compromise reading gets stronger. The nearest public signal is narrower: whether Circle freezes the 3.74 million USDC still held, nearly all of it in five wallets, before the thief moves it.

Check Who Can Spend From Every Saved Address

For anyone holding large exchange balances, the trace argues for auditing a withdrawal list by keyholder rather than by address. For each saved destination, the question is which phone, laptop, browser extension or service can sign for it today, and whether that same device also holds the exchange login. Bitquery's point is that one break-in on such a device opens both.

The defenses it suggests follow from that: a hardware key for logging in and for the wallets on the allowlist, the new-address waiting period switched on, and the same watch kept on allowlisted wallets as on the account itself. A payment landing in a wallet you stopped using is a warning sign. Coindoo documented a similar gap when old wallets were drained after traders stopped using a bot — an address you no longer think about can still have someone able to spend from it.