Suspected EU crypto theft estimate rises to $133M: ZachXBT

Update (Nov. 3, 2026, 11:00 am UTC): This article has been updated to include comments from Crypto.com.

Blockchain investigator ZachXBT has raised his estimate of a suspected crypto theft from an unidentified European Union entity to more than $133 million.

On Tuesday, ZachXBT said he identified another $27 million in withdrawals from centralized exchanges, increasing the suspected losses from the $106 million he initially reported on Monday. He said some withdrawals occurred after his primary disclosure.

“My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up,” ZachXBT said Tuesday on his Telegram channel.

He also said that the lack of a proper incident disclosure allowed more than $30 million to be laundered, claiming EU law enforcement could otherwise have frozen the funds. The victim’s identity and allegations of a cover-up remain unverified. 

Bitquery reported that the suspected stolen funds were withdrawn from accounts at Kraken, Crypto.com and OKX. It also found that $ 62.98 million in stablecoins was converted into 27,553 Ether (ETH) within roughly four hours. As of 13:47 UTC Monday, approximately $78.3 million remained in wallets linked to the suspected attacker, while $30.5 million had moved out of the tracked addresses.

Only $3.74 million remained in USDC that issuer Circle could potentially freeze, according to Bitquery.

Crypto.com told Cointelegraph that it had taken steps to prevent funds associated with the incident from moving through its platform.

“We are aware of this report and have taken appropriate action to block any funds associated with this third-party incident from moving through Crypto.com,” a spokesperson said. “Our platform remains fully operational, and all user funds are secure and accessible.”

OKX acknowledged Cointelegraph’s request for comment and said it was looking into the matter. Kraken had not responded to a request for comment at the time of publication.

ZachXBT said earlier that the attacker was swapping funds into ETH and Monero (XMR) through instant exchanges and cross-chain bridges. He added that the laundering patterns did not match those typically used by North Korea’s Lazarus Group.

Related: North Korea denies role in $6.3B Binance hack, points finger at US