On November 2, 2026, Unchained reported that onchain investigator ZachXBT flagged a suspected theft from an entity in the European Union. Decrypt published the same day that an unnamed EU entity is suspected of losing more than $106 million from several of its accounts on centralized exchanges on Sunday. Unchained wrote that more than $106 million may have been stolen on Nov. 1 from an EU entity’s accounts at multiple centralized exchanges. ZachXBT said Monday in a post to his Telegram channel, and Unchained described a community alert on Nov. 2, that the suspected thief withdrew the funds as USDC and USDT by what Decrypt quoted him calling an “illicit actor.”
Why It Matters
In the 24 hours that followed, ZachXBT said the actor moved aggressively to cover their tracks. Unchained reported that in the 24 hours before the alert the actor was “aggressively swapping USDC for ETH,” then sent money to instant exchanges including WellWallet and Kyrrex, converted part of it to Monero (XMR) through Wagyu, and bridged assets across multiple blockchains. Decrypt noted that Monero hides senders, receivers and amounts, which can make later tracing harder than for USDC or ETH on public ledgers. Decrypt reported that ZachXBT published 11 Ethereum addresses tied to the suspected theft, as Unchained also described, giving investigators a visible slice of the trail while privacy-coin conversion runs in parallel.
For traders who keep size on centralized accounts, the episode is a reminder that compromise can mean account-level withdrawals rather than a headline venue hack alone. Unchained wrote that the post did not identify the entity, the exchanges or how the accounts were accessed, and Decrypt said ZachXBT didn’t name the victim. Both outlets report stablecoin withdrawals from centralized exchange accounts, but neither establishes how the accounts were accessed. As of publication, no exchange or victim had publicly confirmed a loss, so the dollar figure remains an investigator’s assessment, not a confirmed corporate disclosure. ZachXBT said with “a high degree of confidence” that the attacker isn’t North Korea’s Lazarus Group, citing multiple laundering indicators in Decrypt’s account. Unchained quoted him saying he could “say with a high degree of confidence it is NOT Lazarus Group based on multiple laundering indicators,” without spelling out which indicators. The undisclosed indicators limit readers’ ability to independently assess his attribution judgment.
Decrypt explained that swapping out of USDC and USDT matters because the companies behind those stablecoins can freeze them. As a contrast, Decrypt cited blockchain analytics firm Elliptic on a recent record-setting centralized exchange heist: Tether froze stolen USDT on Ethereum in 37 minutes, and Circle froze all $823 million in stolen USDC, helping lock up about 44% of the haul. Decrypt added that it’s unclear whether any funds in the EU case have been frozen. On our reading, rapid movement into ETH, instant swaps and Monero can narrow the window in which issuer freezes still reach traceable balances, though neither outlet reports a freeze action in this case.
Go deeper
- Perp DEX vs CEX — custody and venue structure for perpetual futures.
- AI trading agents and scoped permissions — API and key hygiene when accounts can move size.
On LeverUp, perpetual futures trade through a protocol-managed virtual liquidity architecture.