- Trending
- Comments
- Latest
On-chain investigator ZachXBT suspects a large Western European financial institution is covering up a crypto theft he now puts at more than $133 million, according to a November 3, 2026 post on his Telegram channel. He has not named the institution, and neither the victim nor the cover-up claim has been independently confirmed.
In his initial disclosure, ZachXBT said the suspected attacker had spent the preceding 24 hours aggressively converting the withdrawn stablecoins into Ether (ETH), moving funds through instant exchange services and subsequently converting some of the assets into Monero (XMR).
The investigator identified Well Wallet and Kyrrex among the services allegedly used to facilitate the transactions. He also named Wagyu as a platform through which some of the ETH was converted into Monero, before funds were transferred across multiple blockchain networks.
Although the identity of the suspected attacker remained unknown, ZachXBT said he had ruled out North Korea’s Lazarus Group with a high degree of confidence, citing several laundering indicators.
The investigator’s November 2 alert included 11 wallet addresses associated with the suspected theft, providing blockchain researchers and cryptocurrency platforms with identifiable addresses to monitor.
Those addresses were:
0xADd95cD98E0288ba69785E3151E1db86adF8Dd580x29e9D7715D935e0D0D4B0DD0efC952A97E5510200x378B4f150707C283574DC89739608D29036D57d50x795a9d22F233024487161Fe6daFf73397c1626210x730Bcb1296758c377149d7409f98f041cf7239920x12D9012731eb0D54871A31Af5566Eb9ECCa351Db0x5A154f77852ed274Fd6F4c324a1Ee27809052FF70xA1096A66f9ed58A9594A6A1ad67A5472C09072240x90F0b6D51ed2FE2348A45b2C49BC441E959bc5570x8A97BC406180e28b11C5495fA099BF5119c6C6B00xd010cba790a6ab0048da18f2fbe8e3faf463a16aThe initial disclosure did not identify the affected institution or establish how the attacker gained access to the exchange accounts.
On November 3, ZachXBT published a follow-up investigation identifying another $27 million in suspicious withdrawals, bringing the estimated losses associated with the EU crypto theft to more than $133 million.
According to the investigator, some of the additional withdrawals occurred after his November 2 public disclosure, suggesting that suspicious activity continued even after the incident attracted attention.
He also introduced a new working theory: a large financial institution in Western Europe may have been compromised, with an attempt to conceal the incident potentially underway.
“My working theory is that a large financial institution in Western Europe got exploited and is actively being covered up,” ZachXBT wrote.
The investigator disclosed two additional wallet addresses believed to be connected to the suspected theft:
0x5cf70edce65847ef989933c3072fb0e7f335abc10xe378cdccb369a64a0190577787ef61ca2eefa6b2The new addresses expand the list of wallets being monitored as the investigation develops.
However, ZachXBT has not publicly identified the financial institution allegedly affected by the incident. The suspected breach and the claim of a cover-up have also not been independently corroborated.
The revised $133 million figure represents the investigator’s updated estimate of suspected losses. It is not a confirmed financial statement from the unidentified institution.
Details from the initial investigation show how quickly the suspected attacker moved the assets after withdrawing them from centralized exchanges.
According to an on-chain investigation by Bitquery, approximately $62.98 million worth of stablecoins was exchanged for 27,553 ETH within four hours.
The attacker reportedly used instant exchange services to facilitate the conversions before moving portions of the acquired ETH through additional platforms and blockchain networks.
The use of Monero adds another layer of complexity to the investigation. Unlike conventional cryptocurrency transactions, Monero is designed to provide greater transaction privacy, making it more difficult to trace the movement of funds through publicly accessible blockchain records.
Earlier wallet-tracking information from ZachXBT indicated that approximately $78.3 million remained across addresses associated with the suspected attacker. Around $30.5 million had already moved out of the tracked wallets at the time of that update.
The investigation also identified approximately $3.74 million in USDC across the monitored addresses that could potentially be frozen by Circle, the stablecoin’s issuer.
These figures were provided in an earlier tracking update and do not constitute a complete breakdown of the revised $133 million estimate.
The transactions highlight the challenges facing exchanges, blockchain investigators and law enforcement agencies when responding to large-scale cryptocurrency thefts. Funds can move between platforms, assets and blockchain networks within relatively short periods, potentially reducing the time available for intervention.
Beyond the suspected financial losses, ZachXBT has questioned the apparent lack of timely incident disclosure by the unidentified institution.
The investigator argued that the delay allowed more than $30 million to be laundered and suggested that European law enforcement agencies could potentially have frozen some of the funds if the incident had been reported earlier.
His criticism raises questions about the response of financial institutions to cybersecurity incidents involving digital assets, particularly when stolen funds are being transferred through multiple cryptocurrency services.
Early disclosure can allow exchanges, stablecoin issuers and law enforcement agencies to coordinate efforts to identify suspicious transactions, flag associated wallets and restrict the movement of assets where legally possible.
In this case, however, the investigator believes that the response came too late to prevent a substantial portion of the funds from leaving the initially tracked addresses.
ZachXBT maintained that the suspected attacker was not Lazarus Group, although he did not publicly identify another potential perpetrator or disclose the specific laundering indicators behind his assessment.
The identity of the affected institution, the method used to compromise the exchange accounts and the total confirmed losses remain unknown.
The EU crypto theft investigation is still developing, with ZachXBT continuing to monitor wallet activity and suspicious withdrawals.
Further disclosures from the unidentified institution, cryptocurrency exchanges or European authorities could clarify the circumstances surrounding the alleged breach and establish whether more funds can be recovered.
For now, the case involves more than $133 million in suspected losses, 13 publicly identified wallet addresses and unresolved allegations that a major Western European financial institution may have attempted to conceal a significant security incident.
Copyright © 2025 - The Bit Gazette.