Another nine-figure theft has hit crypto, coming just days after the biggest heist in the industry's history.

An unnamed entity in the European Union is suspected of losing more than $106 million from several of its accounts on centralized exchanges on Sunday, Nov. 1. Pseudonymous onchain investigator ZachXBT, known for tracing stolen funds across blockchains, reported the incident on Monday in a post to his Telegram channel.

The funds were withdrawn as USDC and USDT stablecoins by what he called an "illicit actor."

In the 24 hours that followed, the actor moved aggressively to cover their tracks, ZachXBT said. The attacker swapped USDC for ETH, sent funds through instant exchange services such as WellWallet and Kyrrex, converted some of the proceeds to the privacy coin Monero via Wagyu, and bridged assets across multiple blockchains. Cross-chain bridges, which move assets between blockchains, can further fragment the money trail. ZachXBT also published 11 Ethereum addresses tied to the theft.

Instant exchanges let users quickly swap one cryptocurrency for another, often with little identity verification, while Monero conceals senders, receivers and transaction amounts, making it a popular tool for obscuring stolen funds. Swapping out of USDC and USDT is also significant because those tokens are centrally issued and the companies behind them can freeze them. USDC and USDT are among the most widely used stablecoins, and their issuers — Circle and Tether, respectively — have previously moved to freeze balances linked to hacks and sanctioned addresses. That freeze power only reaches funds still held in those tokens, however; once swapped into ETH or Monero, it no longer applies.

ZachXBT said the culprit remains unidentified, but that he could say "with a high degree of confidence" that it is not Lazarus Group, citing multiple laundering indicators. Lazarus is the umbrella name often used for North Korea's state-backed hackers. He did not name the victim.

That assessment sets the theft apart from the record-setting $6.4 billion Binance hack, which the FBI has attributed to TraderTraitor, a North Korean hacking group. In that case, stablecoin issuers moved within minutes: Tether froze stolen USDT on Ethereum in 37 minutes, and Circle froze all $823 million in stolen USDC, helping lock up about 44% of the haul, according to blockchain analytics firm Elliptic. North Korea's launderers have since spread the remaining funds across about 12,000 wallets.

It is unclear whether any funds in the EU case have been frozen. Given the actor's first-day swaps out of stablecoins, any freeze by Circle or Tether would cover only balances still held in USDC or USDT, and the 11 published Ethereum addresses give the public a way to monitor those wallets for further activity.

The incident adds to an already unprecedented week for crypto security. Beyond the record-breaking Binance hack, Brazilian exchange Mercado Bitcoin reported halting withdrawals on Monday after a $40 million hack of its own. Likewise on Monday, payments firm BTCPay Server told merchants to switch off their servers amid reports of hot wallet attacks.