Hackers stole $30 million from a bank, funneled it through freshly opened accounts, and used it to buy cryptocurrency. Investigators followed the money in near real time. The exchanges holding the assets still could not freeze them, because nobody had officially confirmed that a victim existed.

That is the central frustration of a case that Taylor Monahan, security researcher and founder of MyCrypto, unpacked in a conversation with journalist Laura Shin on or around November 4, 2026. In this heist story, the bottleneck was not the blockchain. It was a missing phone call from the bank.

How the money moved

According to the account discussed by Monahan and Shin, the attackers extracted roughly $30 million from accounts at the bank. The funds did not go straight into crypto. They first landed in newly opened fiat accounts, from which the hackers converted the money into cryptocurrency across several centralized exchanges.

Once the money touched public blockchains, it became visible. That is where ZachXBT, the independent on-chain investigator, entered the picture. ZachXBT traced the flow of the stolen funds and attempted to coordinate with the exchanges to have the assets frozen. On paper, this is the ideal scenario: an investigator flags dirty money sitting on regulated platforms that have the technical ability to lock it down. Centralized venues are also where compliance obligations attach — identity checks at onboarding, monitoring of account activity — which is why investigators push their alerts to these platforms first: they are the choke points with both the records and the technical ability to intervene.

In practice, the effort stalled. The bank had not publicly acknowledged the hack and had released no statement about the breach while the tracing was underway. Without that confirmation, the exchanges lacked the verification they needed to act. A third-party investigator asserting that money is stolen is not the same as the owner of the money saying so.

Not exactly Lazarus-grade

Monahan also offered a view on who might be behind the operation. In her assessment, it did not appear to be tied to the Lazarus Group, the North Korea-linked outfit associated with some of the largest thefts in crypto history. Her characterization pointed toward a less sophisticated crew.

That makes the outcome more uncomfortable, not less. If a less polished group can move stolen bank money into crypto while investigators watch, the gaps appear procedural rather than technical.

The discussion also flagged concerns about latency in real-time tracking. Tracing tools can follow funds quickly, but the human and institutional response chain moves at a very different speed. The conversation stressed the need for faster cooperation between financial institutions and exchanges, particularly around the fiat-to-crypto onramp, the point where traditional money becomes digital assets.

Why a missing victim breaks the system

Freezing customer funds is a serious step for any exchange, and a requirement for a confirmed victim functions as a guardrail. Freezing the wrong account risks harming a legitimate customer; releasing flagged funds risks making the platform the last stop before a laundering trail goes cold. That trade-off is exactly why the problem surfaces when the actual victim goes quiet. In this case, the institution that lost the money was the one party whose word could unlock a response, and it had not spoken publicly.

Banks have their own reasons for moving cautiously after a breach: internal investigations, legal review, reputational concerns. None of those timelines align with how fast crypto can move once it hits a public ledger.

The result is an odd inversion. Crypto, often criticized as the opaque side of finance, was the part of this story where the money was visible. The traditional bank was where the information gap sat.

What it means for exchanges, banks, and users

For centralized exchanges, the case highlights an awkward position. They can be the last checkpoint before stolen funds disappear further, yet they are bound by verification standards that depend on outside parties coming forward.

For banks, the lesson concerns the speed of disclosure, at least to the right counterparties. Privately confirming a breach to exchanges holding traced funds is a different act from issuing a press release, and the two do not have to happen on the same schedule.

ZachXBT has repeatedly demonstrated that tracing is the easier half of the problem. This case illustrates the harder half: getting the institutions with the power to act to do so before the money moves again. The signal to watch from here is disclosure. If the bank eventually confirms the breach — publicly, or privately to the platforms that received the trace — the verification those exchanges said was missing would no longer stand in the way. Whether that confirmation arrives while the traced assets are still sitting on exchanges positioned to freeze them is the open question in this case.

This article is based on reporting by CryptoBriefing, edited by John Chen.