Mentioned in This Article
1. What did ZachXBT report about the $106 million theft?
On November 2, the onchain investigator ZachXBT warned in a community alert on his Telegram channel that more than $106 million may have been stolen a day earlier from an EU entity's accounts at several centralized exchanges. The ZachXBT $106 million theft alert says the funds left as USDC and USDT, and that the funds have since moved through instant exchanges toward Monero.
He did not name the victim, the exchanges involved or the method used to reach the accounts, and he described the actor behind the theft as unidentified. As of the time of the alert, neither an exchange nor the affected entity had confirmed a loss, so the figure rests on the investigator's own analysis rather than on any acknowledgment from those involved.
The word "suspected" therefore matters. What is public is a set of addresses, transfers and service labels that ZachXBT assembled, together with his judgment about their meaning. Readers should treat the total as an estimate until the affected parties say otherwise.
Alerts of this kind are a familiar part of how crypto thefts become known. Independent investigators watch large, unusual transfers, label the wallets involved and publish addresses so that exchanges, stablecoin issuers and other investigators can act. The value of such a post lies in its speed: the sooner the addresses circulate, the sooner services that handle the money can decide whether to hold it.
2. Is the Lazarus Group behind it?
ZachXBT said he is highly confident that North Korea's Lazarus Group is not responsible. He cited what he called multiple laundering indicators, but he did not list them, so the reasoning behind the assessment cannot be examined from the alert alone.
The statement is significant because large thefts in this period have often been tied to North Korean groups. The FBI recently attributed the Binance theft to North Korea, and TRM Labs attributed the drain of Binance's hot wallets on October 29 with high confidence to TraderTraitor, a North Korean hacking unit. Against that backdrop, an investigator ruling out the Lazarus Group for a new incident points to a different kind of actor, even though the alert offers no further identification.
Attribution in these cases usually relies on patterns: the choice of laundering services, the timing of transfers, the way funds are split and recombined, and overlaps with earlier incidents. ZachXBT's remark suggests that the patterns he saw here did not match the behavior he associates with that group.
It is also worth noting what the alert does not say. It gives no estimate of when the thief gained access, no description of the technique and no indication of whether the accounts belonged to a single organization or several. Each of those unknowns affects how the incident should be classified, whether as a compromise of credentials, an insider problem or something else.
3. How are the ZachXBT $106 million theft funds being traced?
According to the alert, the thief aggressively swapped USDC for ether (ETH) in the 24 hours before the post. The funds went to instant exchanges, including WellWallet and Kyrrex. Part of the money was converted into Monero through the swap service Wagyu, and funds were bridged across several chains.
ZachXBT listed 11 Ethereum addresses connected to the theft. A flow graph credited to ZachXBT, Specter and TRM Labs labels the source wallets only as Exchange 1, Exchange 2 and Exchange 3, which leaves the exchanges unidentified.
The graph highlights several movements. About 2.64 million USDC went on November 2 to an address that feeds a cluster tagged as Wagyu. A transfer of 2,200 ETH went to an address that then bridged funds to a Tron-format address. A separate cluster carries a Kyrrex tag, and other instant exchanges appear in the graph without being named.
The article that reported the alert did not reconcile the $106 million total with these particular movements, and the individual transfers shown account for only a portion of it. The gap is not explained, which is another reason the overall figure should be read with care.
For readers unfamiliar with this kind of analysis, the labels matter. Analytics firms such as TRM Labs build clusters of addresses believed to be controlled by the same service or actor, and they tag those clusters with names. A tag does not prove wrongdoing by the service; it only indicates that the funds passed through an address associated with it.
4. Why does the move into Monero complicate recovery?
Monero is a privacy-focused cryptocurrency that conceals senders, receivers and amounts by default. Once stolen funds are converted into it, they become far harder to follow than USDC or ETH, whose transactions are fully visible on public ledgers.
That is why thieves often route funds toward privacy assets. Stablecoins such as USDC and USDT can be frozen by their issuers when a theft is reported in time, and funds sitting at known addresses can be flagged by exchanges and analytics firms. Swapping into ETH and then into Monero removes the funds from the places where those controls work.
The trail that remains visible consists of balances held at public Ethereum addresses and the hops through named services. Because instant exchanges and swap services act as the points where assets change form, they are where investigators and compliance teams concentrate their attention.
The distinction between a transparent and an opaque ledger is central here. On Ethereum and Tron, anyone can look up an address and see its history. On Monero, ring signatures and stealth addresses are used to hide that information, so once funds arrive there, the public record no longer shows where they go next.
5. What are instant exchanges and why do thieves use them?
Instant exchanges are services that swap one asset for another without requiring an account or a lengthy process, often with minimal identity checks. A user sends one asset to a deposit address and receives another at a destination address. That design is convenient for ordinary users who want a quick conversion, but it also suits anyone trying to break the link between a source wallet and the final destination.
In this case the alert names WellWallet and Kyrrex as instant exchanges that received funds, and Wagyu as the swap service used for the Monero conversion. Naming them is useful because a service that learns it is handling stolen funds can, if it chooses, halt the transfers or provide information to investigators. Whether any of the named services did so is not stated in the alert.
Bridging adds another layer. Moving value from one blockchain to another through a bridge changes the ledger on which the funds are recorded, which forces analysts to follow the money across separate systems. The alert notes that funds were bridged across several chains, including a path toward a Tron-format address.
For exchanges, the lesson is operational. Services that accept swaps need monitoring that can recognize rapid conversions from stablecoins into ETH and onward, particularly when addresses have been publicly flagged. Doing so quickly is often the difference between a freeze and a loss.
6. How does this follow the Binance theft?
The alert comes only days after the October 29 drain of Binance's hot wallets, a theft that attracted a coordinated response from investigators, exchanges and law enforcement. That earlier case showed how quickly the industry can try to trace and limit the movement of stolen funds when many parties cooperate.
The present case is different in at least two ways stated in the alert. The victim is described as an entity in the European Union, and the investigator says the culprit is not the Lazarus Group. Whether the same speed of cooperation can be achieved depends in part on whether the exchanges involved confirm the loss and share information, which has not yet happened publicly.
The two incidents together illustrate how much of the crypto-security picture is assembled in public by independent analysts before institutions comment. Alerts like this one often serve as the first notice to exchanges that funds from a theft may be arriving at their platforms.
Another point of comparison is scale. A theft of more than $106 million, if confirmed, would be large by any normal standard, even though it follows a far bigger incident. That context can make a loss of this size seem modest when it is in fact substantial for the affected entity and its counterparties.
7. What should be watched next?
The most important developments would be confirmation from the affected entity or the exchanges, and any freeze of the stablecoins and ETH that remain at the 11 listed addresses. A statement from the victim would also clarify whether the $106 million figure holds, and how the accounts were accessed.
Further movement of the funds will also be informative. If more of the money is converted into Monero, the visible portion of the trail shrinks. If funds linger at public addresses or at named services, there is more opportunity for intervention.
Until those details emerge, the alert stands as an early, unconfirmed account. It is nonetheless a clear example of how a theft can unfold in hours: stablecoins out of exchange accounts, a rapid swap into ETH, a pass through instant exchanges, and a partial conversion into a privacy coin.
For now, the useful facts are the 11 addresses, the named services and the conversion into Monero. Those are the elements that other investigators and the platforms involved can check for themselves, and they will determine how much of the stolen value can eventually be recovered.