ZachXBT Raises Suspected EU Crypto Theft to $133M
English | News | Latest News
Bitcoin, Ethereum, Altcoins, Blockchain, Regulation, Markets, Features, Magazine, Reviews, Research, Opinion, Podcasts, Newsletters, Commissioned Articles, Press Releases, Special Projects
About | About Cointelegraph | History of Cointelegraph | Editorial Policy | Ads Disclosure | Financial Risk Disclaimer
-
Cryptocurrency Market Data:
- DOGE: $0.07376 (-1.95%)
- TRX: $0.3212 (+1.80%)
- LINK: $11.07 (-2.27%)
- ZEC: $1,131.19 (-10.02%)
- ADA: $0.1859 (-2.52%)
- XRP: $1.25 (0.00%)
- ETH: $2,255.26 (-1.47%)
- BTC: $76,656.51 (-1.86%)
- XMR: $624.05 (+3.00%)
- BNB: $692.64 (-2.30%)
- XLM: $0.1610 (-3.75%)
- SOL: $91.72 (-2.73%)
- HYPE: $83.14 (-3.64%)
Text:
Suspected EU crypto theft estimate rises to $133M: ZachXBT
Latest News
Published: Nov 3, 2026
Blockchain investigator ZachXBT has raised his estimate of a suspected crypto theft from an unidentified European Union (EU) entity to more than $133 million.
On Tuesday, ZachXBT identified another $27 million in withdrawals from centralized exchanges, building upon his initial report of $106 million on Monday. Some of these withdrawals occurred after his initial disclosure.
"My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up," ZachXBT stated on his Telegram channel.
He further claimed that a lack of proper incident disclosure enabled over $30 million in laundering, suggesting EU law enforcement could have frozen the funds if the incident had been properly reported. The victim's identity and allegations of a cover-up remain unverified.
Bitquery reported a significant movement of stablecoins into Ether (ETH): $62.98 million in stablecoins converted into 27,553 ETH within four hours. As of 13:47 UTC Monday, approximately $78.3 million remained in wallets linked to the suspected attacker, while $30.5 million had been moved out.
ZachXBT noted that only $3.74 million of USDC, issued by Circle, was potentially subject to freezing by authorities.
He previously observed that the attacker was swapping funds into ETH and Monero (XMR) through instant exchanges and cross-chain bridges. He ruled out the possibility of involvement by North Korea’s Lazarus Group, stating that the laundering patterns did not align with their typical methods.