$106 Million Mystery Crypto Heist Hits EU Entity Days After Binance Breach

The crypto industry is facing another major security incident after an unidentified entity in the European Union reportedly lost more than $106 million in digital assets, just days after a record-breaking hack involving Binance.

The suspected theft was disclosed on November 2 by pseudonymous blockchain investigator ZachXBT, who said the funds had been taken from several accounts belonging to the unnamed entity on centralized cryptocurrency exchanges.

According to ZachXBT, the attacker withdrew the funds in USDC and USDT stablecoins before beginning a series of transactions apparently designed to make the money harder to trace.

The incident adds to a turbulent period for crypto security, with major breaches also affecting Binance, Brazilian exchange Mercado Bitcoin and payment infrastructure provider BTCPay Server.

Attacker moves stolen funds across multiple blockchains

ZachXBT said the suspected attacker began moving the stolen assets within 24 hours of the withdrawals, using several services and cryptocurrencies to complicate efforts to track the funds.

The laundering process reportedly involved converting USDC into Ethereum (ETH), routing assets through instant exchange platforms including WellWallet and Kyrrex, and exchanging part of the funds for Monero through Wagyu. The actor also transferred assets across multiple blockchain networks.

The investigator published 11 Ethereum addresses allegedly linked to the theft, providing potential leads for further blockchain tracking.

The use of different services and assets is significant. Instant exchange platforms allow users to swap cryptocurrencies quickly, while privacy-focused Monero is designed to conceal transaction details, including the identities of senders and recipients and the amounts transferred.

Moving away from USDC and USDT may also be an attempt to reduce the risk of the stolen funds being frozen. Both stablecoins are issued by companies that can blacklist addresses and restrict access to tokens under certain circumstances.

ZachXBT rules out Lazarus Group with high confidence

The identity of the attacker and the affected EU entity remain unknown.

However, ZachXBT said he was confident the incident was not the work of North Korea-linked Lazarus Group, citing several indicators in the laundering activity. He described the assessment as one made with a high degree of confidence but did not identify an alternative suspect.

This distinguishes the incident from the recent Binance breach, which the FBI attributed to TraderTraitor, a North Korean hacking group.

The two cases also differ in the response of stablecoin issuers. Following the Binance incident, Tether froze the stolen USDT on Ethereum within 37 minutes, while Circle froze the full $823 million in stolen USDC. According to blockchain analytics firm Elliptic, those interventions helped immobilize approximately 44% of the total funds involved in that breach.

By contrast, it remains unclear whether any assets connected to the latest EU-related theft have been frozen.

Crypto security faces mounting pressure after Binance hack

The suspected $106 million theft comes amid a particularly difficult stretch for the digital asset industry.

The Binance incident, estimated at approximately $6.4 billion in the source report, has already been described as the largest crypto heist in history. Investigators have since reported that North Korean-linked launderers distributed the remaining funds across roughly 12,000 wallets, complicating recovery efforts.

Other incidents have added to the pressure. Brazilian cryptocurrency exchange Mercado Bitcoin reported suspending withdrawals after suffering a separate $40 million security breach. Meanwhile, BTCPay Server warned merchants to shut down their servers following reports of attacks targeting hot wallets.

The succession of incidents highlights the security challenges facing exchanges, payment infrastructure providers and other businesses responsible for safeguarding digital assets.

Another test for crypto's ability to contain stolen funds

The latest theft also raises questions about how effectively the industry can respond when attackers move assets across stablecoins, exchanges, privacy-focused cryptocurrencies and multiple blockchain networks.

The Binance case demonstrated that stablecoin issuers can intervene quickly to freeze certain stolen assets. But the EU-related incident illustrates how attackers may attempt to evade those controls by converting funds into other cryptocurrencies and routing them through different services.

That does not mean the stolen funds are necessarily beyond recovery. Blockchain transactions can leave traceable records, and exchanges and service providers may be able to identify or restrict suspicious activity when alerted. However, the use of privacy-focused assets and cross-chain transfers can make investigations more difficult.

For now, the victim remains unidentified, the alleged attacker has not been named, and the status of the stolen funds is unknown. As investigators follow the transaction trail, the incident adds another reminder that security remains a critical challenge for an industry seeking broader institutional adoption.