ZachXBT Reports $106M Crypto Theft Involving Exchange Accounts
Ecosystem
English | News | Latest News
- Bitcoin
- Ethereum
- Altcoins
- Blockchain
- Regulation
- Markets
- Features
- Magazine
- Reviews
- Research
- Opinion
- Podcasts
- Newsletters
- Commissioned Articles
- Press Releases
- Special Projects
About | About Cointelegraph | History of Cointelegraph | Editorial Policy | Ads Disclosure | Financial Risk Disclaimer
Market Data (as of Nov 2, 2026):
- DOGE: $0.07449 (-1.88%)
- TRX: $0.3203 (+2.24%)
- LINK: $11.12 (-2.29%)
- ZEC: $1,156.47 (-7.55%)
- ADA: $0.1897 (-2.21%)
- XRP: $1.25 (-0.51%)
- ETH: $2,261.30 (-1.28%)
- BTC: $77,242.40 (-1.50%)
- XMR: $605.09 (+0.45%)
- BNB: $700.04 (-1.97%)
- XLM: $0.1625 (-3.84%)
- SOL: $92.45 (-2.73%)
- HYPE: $84.48 (-3.99%)
Written by:
- Nate Kostar, staff writer
- Edited by: Bryan O'Shea, staff editor
Crypto investigators flag suspected $106M theft, $786K Solana bot drain
Latest News
Published: Nov 2, 2026
An unidentified entity in the European Union may have lost over $106 million from multiple cryptocurrency exchange accounts on Sunday, according to blockchain investigator ZachXBT.
In a post on Monday, ZachXBT revealed that suspected stolen funds were withdrawn in USDC and USDT, then moved through various cryptocurrencies and blockchains. The attacker is believed to have:
- Swapped USDC for Ether (ETH)
- Used instant exchange services like WellWallet and Kyrrex
- Converted funds into Monero (XMR) through Wagyu.
While the attacker remains unidentified, ZachXBT ruled out a connection to North Korea's Lazarus Group based on the movement of funds.
Additionally, a wallet associated with King, an automated trading bot on Solana, may have lost approximately $786,000 on Monday, as reported by blockchain monitoring account Onchain Lens. King is an arbitrage bot that buys and sells cryptocurrencies to profit from price differences. Onchain Lens suspects a wallet compromise based on "unusual fund movements, rapid transfers, and the subsequent cross-chain movement of funds."
These incidents follow the $6.3 billion Binance hack on October 29, attributed to North Korean hackers linked to Lazarus.