$106 Million Crypto Theft Hits EU Entity With Multiple Exchange Accounts

An unidentified organisation in the European Union may have lost more than $106 million from accounts held at several crypto exchanges on November 1. Millions of dollars then moved through cryptocurrency wallets within minutes.

Blockchain investigator ZachXBT raised the alarm on Monday. The suspected attacker reportedly withdrew USDC and USDT, two cryptocurrencies designed to maintain a value of $1.

BeInCrypto’s review of Ethereum transactions found roughly $80 million in USDC arriving at 11 wallets over 11 hours. In five wallets, around $9.6 million was moved out again within three minutes.

The $106 million estimate includes USDT. No victim or exchange has publicly confirmed the alleged theft.

EU ENTITY REPORTEDLY LOSES $106M IN MASSIVE EXCHANGE THEFTAn unnamed European entity is suspected of losing more than $106 million across multiple centralized exchange accounts on November 1, per @zachxbt The attacker withdrew the funds in $USDC and $USDT before aggressively… pic.twitter.com/fsvS4HbvCW

— BeInCrypto (@beincrypto) November 2, 2026

Why Was the Money Moved So Quickly?

Circle and Tether, which issue USDC and USDT, can freeze their tokens. ETH has no equivalent central issuer.

ZachXBT says the suspected attacker exchanged USDC for ETH, sent funds through instant-exchange services including WellWallet and Kyrrex, and used Wagyu to convert some into Monero (XMR).

Monero hides transaction details, making stolen funds harder to trace. Other funds moved between blockchains.

Interestingly, at least five flagged wallets had received smaller payments from the same source months earlier. That raises questions, although it does not establish when or how any compromise occurred.

Are European Crypto Exchange Users at Risk?

Nobody has identified the victim or affected exchanges. The method of attack also remains unknown. There is currently no public evidence of a wider breach affecting ordinary EU customers.

The incident follows the $6.3 billion Binance hack on October 29. However, ZachXBT says he has “a high degree of confidence” that this attacker is not Lazarus Group, associated with North Korean crypto thefts.

• For now, exchange users should review recent account activity and remove unfamiliar API keys. 
• They should also enable two-factor authentication, preferably using passkeys or authenticator apps.
• Activate withdrawal address restrictions where available.

Anyone noticing suspicious activity should contact their exchange through official channels immediately.

These precautions align with EU cybersecurity guidance.