Crypto Theft Exposes Limits of Exchange Withdrawal Allowlists

An attacker withdrew $108.8 million in USDC from Kraken, Crypto.com and OKX between Nov. 1 and 2, 2026, after gaining access to exchange accounts and wallets that were already approved for withdrawals.

Blockchain analytics firm Bitquery traced the withdrawals to 15 wallet addresses over about 21 hours. Eleven had previously received funds from the same exchanges, and eight had been active before the incident. Some had been used as early as May 2026.

The activity suggests the attacker may have obtained private keys along with exchange login details. Possible access points include a compromised device, wallet infrastructure or an insider. The attacker’s identity and the victim’s identity have not been disclosed. The victim is believed to be a financial institution in Western Europe.

The stolen funds were quickly transferred through newly created wallets. Transfers took a median of about three minutes. One wallet received 43 withdrawals from Kraken within 91 minutes, with each transaction below $50,000.

The attacker exchanged about $62.98 million in stablecoins for 27,553 ETH through UniswapX. Other funds were converted into DAI or transferred through bridges and exchanges. Bitquery traced $8.12 million to a KuCoin deposit address and $4.34 million through the LI.FI bridge. Some transactions involved services linked to Monero conversions.

At 13:47 UTC on Nov. 2, about $78.27 million remained in wallets linked to the theft. The balance included $68.9 million in ETH, $5.6 million in DAI and $3.7 million in USDC. The USDC could be frozen by its issuer. ETH cannot be frozen by an issuer, and DAI has no freeze function.

Blockchain investigator ZachXBT initially estimated that more than $106 million had been stolen. After identifying an additional $27 million, he put the reported loss at more than $133 million. He criticized the lack of a formal incident disclosure and said the delay allowed more than $30 million to be laundered without being frozen by European Union law enforcement.

Withdrawal allowlists restrict transfers to preapproved wallet addresses. They are intended to limit losses after an exchange account is compromised. In this case, the controls did not stop the theft because the attacker allegedly accessed wallets that were already on the approved lists.

Bitquery’s review covered Ethereum transactions linked to the main wallets of Kraken, Crypto.com and OKX. The total loss could be higher if funds moved through other wallets or blockchain networks. The firm recommended separating exchange credentials from wallet keys, using hardware security keys, enabling withdrawal delays where available and monitoring approved wallets for unusual activity.