Blockchain investigator ZachXBT said on Tuesday that the undisclosed crypto loss at an unnamed Western European institution has climbed past $133 million, up from the $106 million figure he cited one day earlier. ZachXBT, who has previously prompted disclosures by going public with crypto breaches, is now alleging that the affected European Union entity is concealing the breach rather than reporting it to EU authorities.

Is an EU bank hiding a crypto hack?

Writing on his Telegram channel early Tuesday, ZachXBT said: "My working theory is a large financial institution in Western Europe was exploited and it's currently being covered up."

According to the investigator, the loss estimate now stands at $133 million after another $27 million in withdrawals were processed through centralized exchanges. The withdrawals have continued even after his initial disclosure on Monday.

Despite repeated flags on the incident, the victim has not been named, and the cover-up claim has not been independently verified.

ZachXBT does not suspect involvement by North Korea's Lazarus Group, the unit implicated in many of the largest breaches to hit the crypto industry, saying the laundering pattern does not resemble the routes typically used by the group. He also noted that more than $30 million of the suspected stolen funds would have fallen within the EU's freeze net had the incident been reported.

Three exchanges drained in a day

Analytics firm Bitquery, which published its own investigation into the theft, tracked $108.8 million linked to the incident on-chain. Transfers began on Sunday, November 1, draining accounts at Kraken, Crypto.com and OKX over roughly 21 hours.

Most of the money moved as USDC to 15 wallets, 11 of which those same exchanges had paid before the theft. That detail led Bitquery to conclude that the attacker held the victim's keys and exchange logins, with the working theory being that the attacker compromised the owner's devices, or at least a device belonging to someone on the victim's team.

Eight of the compromised wallets were Trust Wallet smart accounts. Bitquery stressed that the incident does not indicate a flaw in the Trust Wallet app.

After the theft, the funds were quickly moved from freezable to unfreezable assets. Roughly $62.98 million in stablecoins was exchanged into 27,553 ETH through UniswapX over about four hours, then routed into Monero (XMR), a privacy coin built to conceal transaction details, and across bridges.

Bitquery said about $78.3 million still sat on Ethereum in attacker-linked wallets as of 13:47 UTC on November 2, while the attacker's wallet continues to hold $3.74 million in USDC — money that Circle can still freeze.

Why a bank victim would land differently

ZachXBT's theory points at a category of firm that only recently entered the market. European banks spent 2026 moving into crypto under the bloc's Markets in Crypto-Assets rules, and lenders now account for close to 23% of the crypto-asset service providers on the EU's MiCA register as of September. Deutsche Bank, Germany's largest lender, has been targeting MiCA approval for digital-asset custody. MiCA authorization is what makes that shift possible: licensed crypto-asset service providers can offer services such as custody and exchange, which is how lenders have moved from observers to direct handlers of customer digital assets.

Cryptopolitan's earlier report on the $106 million drain noted the same pattern seen across the Binance and Bitget hacks: attackers convert stablecoins into Ether and privacy coins before Circle or Tether can act.

The disclosure question

The cover-up accusation carries the greatest weight if the victim is a financial entity. Under the EU's Digital Operational Resilience Act (DORA), in force since January 17, 2025, financial firms including crypto-asset service providers must flag and report major ICT-related incidents to supervisors through a first alert, a follow-up update and a closing report, according to France's markets regulator, the AMF.

ZachXBT's point is that the delay carried a direct cost: without disclosure, he argues, roughly $30 million flowed out of reach that authorities could have frozen. Whether any DORA-covered entity is involved remains unconfirmed, and no regulator has named a victim. For now, the story turns on a short list of outstanding facts: the identity of the institution, whether any supervisor confirms receiving an incident report, and whether the remaining freezable USDC is frozen or converted into assets no issuer can touch.