More than $106 million may have been stolen on Nov. 1 from an EU entity’s accounts at multiple centralized exchanges, according to onchain investigator ZachXBT, who said he is highly confident the culprit is not North Korea’s Lazarus Group.
In a community alert posted to his Telegram channel on Nov. 2, ZachXBT said the suspected thief pulled the funds out as USDC and USDT. He wrote that he could “say with a high degree of confidence it is NOT Lazarus Group based on multiple laundering indicators,” without spelling out which indicators.
The post did not identify the entity, the exchanges or how the accounts were accessed, and said the actor “remains unidentified.” As of publication, no exchange or victim had publicly confirmed a loss.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
Where the Funds Went
According to ZachXBT, in the 24 hours before the alert, the actor was “aggressively swapping USDC for ETH,” then sent money to instant exchanges including WellWallet and Kyrrex, converted part of it to Monero (XMR) through the swap service Wagyu, and bridged funds across several chains. He listed 11 Ethereum addresses he tied to the theft.
A flow graph attached to the alert, credited to ZachXBT, Specter and TRM Labs, labels the source wallets only as Exchange 1, 2 and 3. It shows about 2.64 million USDC moving on Nov. 2 to an address that feeds a cluster tagged as Wagyu, and 2,200 ETH going to an address that then bridged funds to a Tron-format address. A separate cluster carries a Kyrrex tag, and several other instant exchanges in the graph are not named.
What Stays Traceable
Funds converted to Monero are far harder to follow than USDC or ETH, because Monero hides senders, receivers and amounts by default. That leaves the balances still sitting at public Ethereum addresses, and the hops through named services such as Kyrrex and Wagyu, as the parts of this trail that remain visible onchain.
Previously
The alert lands days after Binance’s hot wallets were drained on Oct. 29, a theft TRM Labs attributed with high confidence to TraderTraitor, a North Korean hacking unit.
Related Listen: Is THORChain a Money Laundering Service? A Chinese Crime Boss Says Yes
The post $106 Million Suspected Stolen From EU Entity as Funds Flow Into Monero: ZachXBT appeared first on Unchained.
Powered by WPeMatico
