An unidentified European Union entity may have lost more than $106 million in cryptocurrency after suspected unauthorized withdrawals from accounts at multiple exchanges on November 1, blockchain investigator ZachXBT — a pseudonymous on-chain researcher known for publicly tracing stolen funds — reported on Monday in a public Telegram alert.

The researcher said the funds left the accounts as USDC and USDT, two dollar-linked stablecoins issued by Circle and Tether, respectively. The victim, the affected exchanges, and the suspected attacker remain unidentified, and neither the reported loss nor the method of access has been independently confirmed.

11 Wallet Addresses Linked to the Suspected Theft

ZachXBT identified 11 related wallet addresses associated with the suspected theft. His Telegram alert traced transfers from exchange accounts into wallets used to move and convert the assets, and he urged others to monitor the addresses for further movements.

The investigator did not establish whether exchange systems were breached or whether account access was compromised. No affected EU organization or exchange has publicly confirmed the reported withdrawals, and investigators have not published a final, detailed breakdown of the losses. Publicly flagging addresses is a standard step in on-chain investigations — exchanges and compliance teams routinely watch such wallets, and deposits traced to thefts can be frozen or blocked once they reach platforms or issuers with the ability to intervene.

Stablecoins Converted and Moved Across Multiple Networks

According to the alert, the suspected attacker exchanged USDC for ether, a conversion step also reported during last week's Binance hack. The transfers then continued through WellWallet and Kyrrex, and some funds were reportedly converted into Monero through Wagyu before being moved between blockchains.

Monero obscures transaction details by design — the privacy-focused cryptocurrency is built to conceal senders, recipients, and amounts — while the issuers of USDC and USDT can freeze those stablecoins under certain conditions. With the relevant addresses now publicly flagged, any further movement of the funds, or a freeze action by Circle or Tether, would be visible in on-chain records.

ZachXBT Rules Out Lazarus Group

ZachXBT said several patterns in the fund movements gave him strong confidence that Lazarus Group was not responsible for the suspected theft. He did not identify another suspect or explain each indicator publicly.

In a separate case, researchers linked the Binance attack to TraderTraitor, a North Korean group linked to Lazarus, the collective repeatedly tied by governments and security firms to major cryptocurrency thefts. Security researchers estimated that Binance lost about $6.3 billion in the October 29 incident.

Other Crypto Platforms Report Security Incidents

The suspected theft was reported alongside a series of other security issues in the industry. Brazilian exchange Mercado Bitcoin disclosed a security incident after researchers flagged more than $40 million in suspicious transfers. The company said customers were unaffected and temporarily suspended deposits and withdrawals.

Separately, BTCPay Server warned that attackers had drained funds from older versions of its software. According to the company, versions 2.4.1 and older were exposed to an identified attack method, while its latest 2.4.7 release had no credible reports of wallet drains.

Meanwhile, Binance set aside more than $6.34 billion to cover losses from its breach, including $5 billion held in affected tokens.