ZachXBT Flags Suspected $106M Crypto Theft as Solana Bot Faces Possible $786K Drain
Key Takeaways
- •ZachXBT reported that an unidentified European Union entity may have lost over $106 million from accounts at multiple cryptocurrency exchanges.
- •The suspected attacker withdrew funds in USDC and USDT, swapped them into Ether, and converted them into Monero using services such as WellWallet, Kyrrex, and Wagyu.
- •ZachXBT said the movement of the funds suggests no connection to North Korea's Lazarus Group, while the affected entity and exchanges remain publicly unnamed.
- •Eleven wallet addresses associated with the stolen funds were disclosed, allowing exchanges and blockchain-monitoring services to flag the assets as they move.
- •Onchain Lens reported that a wallet tied to the King arbitrage bot on Solana may have lost about $786,000, with rapid cross-chain transfers via Mayan suggesting a possible wallet compromise.
Blockchain investigator ZachXBT — a pseudonymous on-chain researcher known for tracing stolen funds — reported on Monday that an unidentified entity in the European Union may have lost more than $106 million from accounts at multiple cryptocurrency exchanges on Sunday.
According to the investigator's Telegram post, funds suspected to have been stolen were withdrawn in USDC and USDT, the two largest stablecoins pegged to the US dollar, before being moved through several cryptocurrencies and blockchains. The suspected attacker swapped USDC for Ether (ETH), used instant exchange services including WellWallet and Kyrrex, and converted funds into Monero (XMR), a privacy-focused cryptocurrency whose ledger obscures senders, recipients and amounts, through the swap service Wagyu.
The suspected attacker remains unidentified, though ZachXBT said the movement of funds pointed away from a link to North Korea's Lazarus Group. Neither the affected entity nor the exchanges involved have been publicly named, leaving key details of the incident unresolved. ZachXBT identified 11 wallet addresses associated with the funds, a disclosure that allows exchanges and blockchain-monitoring services to flag the assets as they move.
The reported theft follows the $6.3 billion Binance hack on Oct. 29, which the FBI has attributed to North Korean hackers known as “TraderTraitor,” a group linked to Lazarus. The attack was the largest cryptocurrency theft on record, and its aftermath has kept exchange security and the movement of funds across blockchains under close scrutiny.
Related: Binance net outflows surge to $5.8B as withdrawals resume after record hack
Wallet associated with Solana arbitrage bot may have lost $786K
A wallet associated with King, an automated trading bot on Solana, may have lost about $786,000 on Monday, according to pseudonymous blockchain monitoring account Onchain Lens. King is an arbitrage bot — software that automatically buys cryptocurrency in one market and sells it in another to profit from price differences.
Onchain Lens told Cointelegraph that the funds moved through several Solana wallets before being transferred to Ethereum using Mayan, a service for moving assets between blockchains. It said the rapid transfers suggested an attempt to conceal the funds' origin and a possible wallet compromise. King's operator has not confirmed a compromise, leaving the cause of the unusual outflows unverified.
“Our report is based on unusual fund movements, rapid transfers and the subsequent cross-chain movement of funds, which we believe indicates an attempt to obscure their origin,” Onchain Lens told Cointelegraph. “This pattern strongly suggests a potential wallet compromise.”
Source: Onchain Lens on X
Magazine: Binance hackers raced to move billions before it could be frozen
