Unidentified EU Institution $133M Crypto Theft

On November 1, 2026, an unidentified European Union institution had roughly $133 million in stablecoins drained from its centralized-exchange accounts over a single weekend. Investigator ZachXBT first flagged the theft publicly on November 2, and the identity of the victim — and of the attacker — remained unknown as the stolen funds were rapidly converted and bridged out of reach.

What happened

Starting Sunday, November 1, attacker-controlled addresses pulled USDC and USDT out of accounts the victim held at several centralized exchanges. ZachXBT initially tallied more than $106 million across eleven wallet addresses, then raised the estimate to over $133 million on November 3 after identifying roughly $27 million in further withdrawals. On-chain analytics firm Bitquery attributed the outflows to accounts at Kraken, Crypto.com and OKX, counting about $108.8 million in USDC alone over a window of roughly 21 hours. Rather than a smart-contract exploit, the pattern pointed to an owner-side compromise: the attacker appeared to hold both the exchange logins and the private keys for wallets the victim used, so every withdrawal executed as a legitimate, authenticated action. The method of initial access was never made public.

Aftermath

The attacker laundered quickly. About $62.98 million in stablecoins was swapped into roughly 27,553 ETH within four hours, largely through UniswapX, with portions routed through instant-exchange services and bridged into Monero. Tether froze a slice of the stolen USDT, while Circle had not frozen the remaining USDC at the time of reporting, and both Crypto.com and OKX said they were acting on or reviewing the linked accounts. ZachXBT alleged the victim had failed to disclose the breach to authorities, letting more than $30 million be laundered that might otherwise have been frozen. He also said he was highly confident the laundering patterns did not match North Korea's Lazarus Group.

Why it matters

The theft is a reminder that the most damaging crypto losses increasingly come not from novel contract bugs but from compromised credentials and keys on the victim's side — the same failure mode behind the Mercado Bitcoin hot-wallet drain days earlier and the record Binance breach. It also highlights a disclosure gap: when a victim stays silent, laundering proceeds unimpeded, and the only public accounting comes from independent on-chain sleuths rather than the institution that lost the money.