Kraken said it has restricted accounts linked to a suspected crypto theft of more than $133 million and is working with law enforcement agencies to recover the funds. The exchange issued its statement after blockchain investigator ZachXBT identified additional withdrawals connected to the alleged incident. The victim's identity and the method used to access the funds remain unknown.

Because the funds were allegedly dispersed across several trading platforms, the response has involved on-chain investigators, analytics firms, and multiple exchanges working in parallel.

Kraken responds as loss estimate grows

Kraken said it was investigating reports that some of the allegedly stolen assets subsequently moved through accounts on its platform. The company added that its security systems were not compromised, no customer accounts had been taken over, and customers faced no ongoing risk — an indication that the suspected theft did not originate on the exchange's own infrastructure.

Restricting flagged accounts is a common step exchanges take when assets tied to suspected illicit activity reach their platforms, since restricted accounts cannot be used to move the funds further while an investigation is underway.

ZachXBT first reported the alleged theft on November 2, saying an EU-based organization had been targeted. He stated that roughly $106 million had allegedly been stolen from the victim across multiple exchanges on November 1. On November 3, he raised the estimate to more than $133 million after locating an additional $27 million in withdrawals, some of which occurred after he issued his public alert, he said. He indicated the victim was a large financial institution in Western Europe.

Investigators trace funds across exchange accounts

Blockchain analytics firm Bitquery separately traced USDC withdrawals worth $108.8 million from wallets it identified as belonging to Kraken, Crypto.com, and OKX. Bitquery examined Ethereum transactions involving the exchange wallets on November 1–2, and its narrower coverage and earlier reporting cutoff accounted for the difference between its figures and ZachXBT's. Because Ethereum transactions are recorded on a public ledger, analysts can follow funds between wallets and exchanges, though differences in coverage and timing typically produce varying totals.

According to Bitquery, about $62.98 million in stablecoins was swapped for 27,553 ETH within roughly four hours. As of November 2, around $78.3 million remained in the wallets it linked to the suspected attacker, while about $30.5 million had moved beyond the tracked funds through exchanges, bridges, and other services. That remaining balance, still sitting in identifiable wallets as of that date, is the portion most readily traceable on-chain.

Other exchanges take action

Crypto.com reportedly said it had taken action to block funds linked to the incident from moving through its platform, and that its services remained operational and user funds were safe. OKX also reportedly acknowledged that it was looking into the matter. The responses reflect the cross-venue nature of the incident, with funds traced to wallets at three separate exchanges.

Kraken has restricted the relevant accounts and is assisting law enforcement with recovery efforts. According to ZachXBT, the theft totals more than $133 million. The victim's identity, the initial point of access, and the subsequent path of the roughly $78.3 million still tracked in linked wallets as of November 2 remain the case's central open questions.