ZachXBT tracks suspected $133M crypto outflows; victim remains unidentified
Blockchain investigator ZachXBT raised his estimate of suspected crypto outflows to more than $133 million after tracing another $27 million in withdrawals. The victim, the cause of the outflows and any breach have not been publicly confirmed.
- Estimated outflows: More than $133 million, according to ZachXBT.
- Reported routes: USDC and USDT, swaps into ETH, cross-chain transfers and conversion into Monero.
- Reported controls: About $4.84 million in USDC and USDT was reportedly frozen or blocked.
- Unresolved: The victim and suspected attacker have not been identified.
How the estimate rose above $133 million
In a community alert on November 2, 2026, ZachXBT said an unidentified European entity was suspected of losing more than $106 million through withdrawals from several centralized exchange accounts on November 1. In an update the next day, he added about $27 million in withdrawals that he linked to the same suspected actor, bringing his estimate to more than $133 million.
The figure represents suspected outflows, not a publicly confirmed accounting of a victim’s losses. The entity has not been named, and the available information does not establish how the withdrawals were authorized or whether they followed a compromise.
CryptoTicker reported that Kraken restricted accounts linked to the activity, Crypto.com blocked associated funds and OKX was investigating. These reported steps involve accounts or funds linked to the transfers. They do not show that any exchange’s core systems were breached.
A route through stablecoins, ETH and Monero
ZachXBT described initial withdrawals in USDC and USDT, two dollar-pegged stablecoins. Some USDC was reportedly swapped for ETH over the next 24 hours. Funds also moved between blockchain networks, a process commonly called bridging.
Other reported routes involved the instant exchanges WellWallet and Kyrrex, as well as Wagyu, where funds were converted into XMR, or Monero. Instant exchanges let users swap one cryptocurrency for another. Monero is designed to reveal less transaction information publicly than transparent blockchains such as Ethereum. That can make tracing harder, though not necessarily impossible.
CryptoTicker, citing analytics firm Bitquery, reported that about $62.98 million in stablecoins had been swapped into 27, 553 ETH in roughly four hours. Bitquery’s reported snapshot from early afternoon on November 3 showed about $78.3 million in wallets attributed to the suspected actor and about $30.5 million moved out of observed addresses.
These figures measure different kinds of wallet activity at a particular time. The reporting does not establish whether they overlap, so they should not be added together or treated as a complete balance sheet for the alleged victim. And “moved out” does not, by itself, mean funds were fully laundered or can no longer be traced.
Reported freezes are not the same as recovery
CryptoTicker, citing Cointelegraph, reported that Circle froze about $3.74 million in USDC and Tether blocked approximately $1.1 million in USDT connected to the activity, for a combined total of roughly $4.84 million. The reports did not include direct confirmation from either issuer. It remains unknown whether any frozen or blocked funds have been returned to a victim.
Issuers can restrict certain addresses holding their stablecoins. ETH has no central issuer that can freeze an address in the same way, though a centralized exchange or custodian may restrict assets it controls. So the reported stablecoin total does not measure every fund investigators may be able to trace or recover.
ZachXBT said more than $30 million had already been laundered and argued that European Union law enforcement might have been able to freeze it. That is his assessment. It does not confirm that authorities could have frozen the funds, tried to do so or missed a specific opportunity. The $30.5 million Bitquery figure refers to funds moved out of observed addresses. On its own, it does not prove the money was fully laundered.
The financial-institution theory remains unconfirmed
ZachXBT has suggested that a major Western European financial institution may have been compromised and criticized the apparent lack of public disclosure. The entity remains unidentified, though, and no public evidence cited in the reporting confirms a financial-institution breach or a cover-up.
The EU’s Digital Operational Resilience Act (DORA) has applied since January 17, 2025. It requires entities within its scope to report certain major information and communications technology incidents to supervisors. Those reports are not necessarily public. Whether DORA applies here depends on facts that remain unknown, including the victim’s identity and whether an incident met the relevant reporting threshold. Public silence alone proves neither concealment nor that no incident occurred.
ZachXBT’s assessment of Lazarus
ZachXBT said he was highly confident the suspected attacker was not North Korea’s Lazarus Group, citing laundering indicators he considered inconsistent with the group’s patterns. That is an investigator’s assessment. It does not definitively identify another actor or prove Lazarus was uninvolved.
The transaction trail may offer leads, but it has not publicly established who controlled the wallets, how the initial withdrawals occurred or how much of the suspected total remains recoverable.
Key questions and answers
-
How did the estimate rise above $133 million?
ZachXBT added about $27 million in withdrawals he linked to the suspected activity to his initial estimate of more than $106 million.
-
Has a European financial institution been confirmed as the victim?
No. The entity is unidentified, and the theory that it was a major Western European financial institution remains unconfirmed.
-
Were funds frozen or blocked?
About $4.84 million in USDC and USDT was reportedly frozen or blocked, according to CryptoTicker, citing Cointelegraph. Whether those funds have been recovered is unknown.
-
Did ZachXBT attribute the activity to Lazarus?
No. He said he was highly confident the suspected attacker was not Lazarus, based on laundering patterns he considered inconsistent with the group.
-
Is the full $133 million gone?
That has not been established. The estimate concerns suspected outflows. The funds’ current location and recoverability, as well as the victim’s confirmed loss, remain unknown.
