Over $106M in Crypto Stolen From EU Entity? ZachXBT Tracks Attacker’s Laundering Trail

It seems like the crypto industry can’t catch a break, with one security incident after another. Interestingly, this time, the notorious Lazarus Group may not be behind it.

Blockchain investigator ZachXBT has now flagged a suspected theft of more than $106 million involving multiple centralized exchange accounts linked to an unnamed EU entity on November 1.

Movement of Funds

According to his findings, the stolen funds were withdrawn in USDC and USDT before the attacker began aggressively swapping USDC for ETH, moving funds through instant exchanges such as WellWallet and Kyrrex, and converting them into XMR through Wagyu.

Instant exchanges are platforms that let users quickly swap crypto assets without opening a full centralized exchange trading account, while Wagyu is a non-custodial, cross-chain instant exchange and bridge built for privacy-focused digital assets.

The funds were also bridged across multiple chains. Although the actor remains unidentified, ZachXBT said he is highly confident the activity is not linked to the North Korean threat actor Lazarus Group, based on multiple laundering indicators.

Another Security Incident

Separately, Brazilian crypto exchange Mercado Bitcoin also reported a security incident. According to Local outlet BitNotícias, more than $40 million in suspicious outflows were flagged by blockchain security firm HypernativeLabs across 10 networks, including Bitcoin, Ethereum, and Solana.

Mercado Bitcoin later confirmed the incident and added that it had swiftly contained it. But the exchange insisted that customers were unaffected and no data breach occurred. As a precaution, it temporarily suspended deposits and withdrawals while investigating the incident.

“Our teams are mobilized investigating the case, tracking the assets, and coordinating measures with the competent authorities.”

This comes against the backdrop of the $6.3 billion Binance hack. Additionally, BTCPay Server is investigating reports of unauthorized attackers sweeping hot wallets on older instances. The attack targeted versions 2.4.1 and older, after attackers reportedly gained admin access. The platform said that it has no credible reports of hot wallet drains affecting users on the latest 2.4.7 release and urged users to update their instances.

The post Over $106M in Crypto Stolen From EU Entity? ZachXBT Tracks Attacker’s Laundering Trail appeared first on CryptoPotato.