ZachXBT: EU Institution Suspected of Losing Over $106 Million in Hack, Hackers Transferring Funds via ETH and Monero

Author: TechFlow

TechFlow Summary: Hidden currents in on-chain security have once again produced a rare, massive theft. On November 2, well-known on-chain detective ZachXBT released an urgent community alert, disclosing that an EU-based institutional entity appeared to suffer a devastating blow on November 1, with funds totaling over $106 million in encrypted assets withdrawn abnormally from its accounts at multiple centralized exchanges.

Following the initial fund transfer, the attackers demonstrated highly rapid and sophisticated on-chain money laundering techniques within the past 24 hours. A large volume of stablecoins was swiftly converted into Ethereum, utilizing instant censorship-resistant exchange platforms, cross-chain liquidity routing, and privacy coin Monero to execute multi-layered jumping obfuscation, attempting to completely sever the traceability of the funds.

More critically, based on multi-dimensional money laundering behavioral characteristics, ZachXBT is highly confident that this incident was not carried out by the notorious North Korean hacker group. This massive heist spanning centralized exchange internal controls and decentralized multi-chain mazes has not only triggered another red alert for institutional-grade digital asset custody defenses, but also revealed the rapid evolution speed of new transnational professional cybercrime networks.

$106 Million Vanished: EU Entity Suddenly Faces Large Withdrawals from Exchanges

According to the ZachXBT Community Alert, an institution registered in the EU suffered a sudden security incident on November 1. Without authorization, the attackers centrally withdrew huge assets worth over $106 million from multiple centralized exchange (CEX) custody accounts under the entity's name.

On-chain address activity logs show that the stolen funds were initially rapidly drained from exchange hot wallets as US dollar stablecoins USDC and USDT. The large stablecoin volumes were split and dispersed across 11 core attacker addresses within a short timeframe, showcasing the attackers' profound familiarity with target account permissions and withdrawal protocols.

As of now, the specific identity of the attacked institution and the exchange's risk control details have not been fully disclosed. However, the scale of over $100 million involved directly places it among the largest known institutional security incidents since the second half of the year, causing strong shockwaves in the crypto asset management and liquidity provider sectors.

Converting to ETH and Transitioning to Monero: Multi-Chain Routing Weaves a Money Laundering Maze

After securing the funds, the attack group launched intensive on-chain laundering operations within the past 24 hours. To prevent potential on-chain address freezes by stablecoin issuers Circle and Tether, the hackers aggressively swapped all USDC for native ETH through decentralized trading protocols first.

Subsequently, the laundering network began penetrating deeply into decentralized cross-chain and instant exchange platforms. Attackers densely funneled assets into instant exchange channels like WellWallet and Kyrrex that bypass KYC requirements, and utilized cross-chain protocols such as Wagyu to quietly convert massive funds into the highly anonymous Monero (XMR).

In addition to converting to privacy tokens, the hackers repeatedly performed cross-chain asset jumps between multiple mainstream blockchain networks, using non-custodial cross-chain bridges to fragment the cash flow into extremely minute micro-pieces. This mesh-like expanding laundering chain significantly increased the analysis costs for on-chain anti-money laundering (AML) tracking systems.

Excluding Lazarus Suspicions: Characteristic Profile of a New Professional Cybercrime Network

Addressing public speculation that the perpetrator is consistently pointing to North Korean hackers, ZachXBT provided extremely clear technical counter-evidence in his report. He emphasized that based on transfer pacing, channel selection, and multiple deep laundering characteristic metrics, it is highly certain that this attack operation was absolutely not conducted by the state-sponsored hacker group Lazarus Group.

Unlike the fixed cross-chain jumpboards and specific aggregation models routinely used by Lazarus, this case demonstrates aggressive utilization of small-to-medium instant trading platforms and faster Monero cash-out speeds. This unique modus operandi aligns more closely with the characteristics of civilian transnational professional criminal syndicates possessing advanced internal control penetration capabilities.

This assessment reveals a more severe fact to the cybersecurity industry: besides state-sponsored APT groups, global civilian cybercrime industries are rapidly absorbing advanced on-chain laundering tools. Professional criminal clusters capable of cross-CEX penetration and cross-chain mixing are emerging as a tangible threat that institutional capital cannot ignore.

Exchange Defenses Questioned Again: Blind Spots and Warnings in Institutional-Grade Custody

The outbreak of this massive case has once again thrust the security protection of institutional accounts at centralized exchanges into the spotlight. The ability of attackers to penetrate the large-scale risk control barriers of multiple mainstream exchanges within a short time and consecutively withdraw $106 million exposes the vulnerable boundaries of traditional API key or credential-based management.

For institutional investors holding large-scale crypto assets, unilaterally storing assets in traditional trading accounts makes it extremely easy to suffer total losses due to insider employee permissions being compromised via hacker phishing or social engineering breakthroughs. Adopting Multi-Party Computation (MPC) and time-lock delayed approval has become an insurmountable rigid baseline.

Currently, major compliance analysis firms are collaborating with global exchanges to urgently mark and block the 11 blacklisted addresses involved on-chain. However, as a considerable portion of the funds has already vanished into the anonymity fog of Monero, whether this transnational mega-case can successfully recover the losses will directly test the emergency response limits of global inter-agency judicial coordination.