ZachXBT lifts suspected EU crypto theft estimate above $133M

Blockchain investigator ZachXBT raised his estimate of a suspected crypto theft from an unidentified European Union entity to more than $133 million after identifying another $27 million in withdrawals from centralized exchanges.

On Tuesday, Nov. 3, ZachXBT reported the additional withdrawals, raising his initial estimate from $106 million. Some of the withdrawals occurred after his first disclosure on Monday, Nov. 2.

“My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up,” ZachXBT wrote on Telegram. The identity of the suspected victim and the allegation of a cover-up have not been independently verified.

ZachXBT reported that more than $30 million had been laundered after the lack of a formal incident disclosure. He added that law enforcement agencies in the European Union might otherwise have been able to freeze some of the funds.

Blockchain analytics firm Bitquery reported that $62.98 million in stablecoins was converted into 27,553 Ether within about four hours. At 13:47 UTC on Monday, Nov. 2, about $78.3 million remained in wallets linked to the suspected attacker, while $30.5 million had moved out of the tracked addresses.

About $3.74 million remained in USD Coin, which issuer Circle could potentially freeze. ZachXBT had previously reported that the suspected attacker was converting funds into Ether and Monero through instant exchanges and cross-chain bridges. In a separate investigation, ZachXBT linked over $20 million in illicit flows to a Monero swap service operating on Hyperliquid Core.

The laundering activity did not match patterns commonly associated with North Korea’s Lazarus Group, according to ZachXBT. The available blockchain data does not identify the victim or confirm who carried out the transactions.