Overview
- An unnamed European Union entity reportedly had more than $106 million removed from multiple centralized exchange accounts, with the withdrawals said to have occurred on Sunday.
- Blockchain investigator ZachXBT published 11 Ethereum addresses tied to the transfers and urged others to monitor those wallets for further movement.
- Tracing shows the attacker moved funds as USDC and USDT into ETH, passed them through instant exchanges including WellWallet and Kyrrex, converted portions to Monero via Wagyu, and used cross‑chain bridges to obscure provenance.
- ZachXBT said he has high confidence the North Korea‑linked Lazarus Group was not responsible, and the victim, access method and any account freezes have not been publicly confirmed.
- The use of Monero and cross‑chain bridges reduces public traceability while the ability of issuers to freeze USDC or USDT and the response of intermediaries will be key to any recovery or law enforcement action.