Kraken has restricted accounts linked to the suspected theft of more than $133 million in cryptocurrency from an unidentified European Union entity, and the exchange says it is working with law enforcement to support recovery efforts.

"This incident did not originate on the Kraken platform, and we're actively investigating reports that some of the assets were subsequently moved through accounts on our platform," Kraken told Cointelegraph. "We've restricted the accounts in question and are working with law enforcement to support recovery efforts."

The company added that its security systems had not been compromised, that no customer accounts had been taken over, and that there was no ongoing risk to its customers.

Kraken's statement follows a disclosure by blockchain investigator ZachXBT, who said on Tuesday that he had identified an additional $27 million in withdrawals from centralized exchanges, raising the suspected losses from the $106 million he reported on Monday and bringing the total above $133 million. According to ZachXBT, some of those withdrawals occurred after his initial disclosure.

Bitquery reported that the suspected stolen funds were withdrawn from accounts at Kraken, Crypto.com and OKX. The analytics firm also found that $62.98 million in stablecoins was converted into 27,553 Ether (ETH) within roughly four hours — a pace that matters for recovery, since issuer freezes can immobilize stablecoins but not assets like Ether.

Crypto.com told Cointelegraph that it had taken steps to prevent funds associated with the incident from moving through its platform. "We are aware of this report and have taken appropriate action to block any funds associated with this third-party incident from moving through Crypto.com," a spokesperson said. "Our platform remains fully operational, and all user funds are secure and accessible."

OKX acknowledged Cointelegraph's request for comment and said it was looking into the matter as of publication.

Bitquery also traced connected transactions to an account at Kyrrex, citing labels from blockchain analytics firm TRM Labs. Kyrrex told Cointelegraph that it was aware of reports concerning the alleged movement of stolen funds and was closely monitoring the situation.

"While we cannot comment on individual transactions, specific wallet addresses or any related internal reviews, Kyrrex stands ready to cooperate with competent law enforcement and regulatory authorities," the company said.

Victim's identity remains unverified

"My working theory is a large financial institution in Western Europe was exploited and it's currently being covered up," ZachXBT said on his Telegram channel.

He also said the lack of a proper incident disclosure allowed more than $30 million to be laundered, claiming that EU law enforcement could otherwise have frozen the funds. The victim's identity and the cover-up allegations remain unverified.

As of 13:47 UTC on Monday, approximately $78.3 million remained in wallets linked to the suspected attacker, while $30.5 million had moved out of the tracked addresses, according to Bitquery. Only $3.74 million remained in USDC that issuer Circle could potentially freeze, while Tether had already frozen $1.1 million in USDT — a combined total covering only a small fraction of the suspected haul, with much of the funds no longer held in freezable stablecoins.

ZachXBT said earlier that the attacker was swapping funds into ETH and Monero (XMR), a privacy-focused cryptocurrency designed to obscure transaction details, through instant exchanges and cross-chain bridges. He added that the laundering patterns did not match those typically used by North Korea's Lazarus Group.

From here, the key developments to watch are further movement from the tracked wallets, any additional freezes by stablecoin issuers, and whether EU authorities or the affected platforms disclose more about the victim or the recovery effort as their cooperation with law enforcement continues.

Related: North Korea denies role in $6.3B Binance hack, points finger at US

Editor's note: This article was updated on Nov. 4, 2026, at 8:20 am UTC to include comments from Kyrrex, following earlier updates on Nov. 3, 2026, that clarified the headline and added responses from Kraken, OKX and Crypto.com.

Source: Cointelegraph