Another Nine-Figure Theft Hits Crypto Sector as Unnamed EU Entity Loses $106 Million Days After Record Binance Heist

The cryptocurrency ecosystem is grappling with an unprecedented wave of digital asset security breaches following a chaotic week marked by multi-million and multi-billion-dollar exploits. Just days after the industry witnessed the largest heist in its history, onchain investigators have revealed yet another staggering nine-figure theft.

An unnamed entity based in the European Union has fallen victim to a sophisticated cyberattack, suffering losses exceeding $106 million across several accounts held on centralized cryptocurrency exchanges. The breach, which took place on Sunday, was brought to light by renowned pseudonymous onchain investigator ZachXBT, who shared initial findings with his followers via his Telegram channel on Monday.

The incident compounds an already fraught period for digital asset security, unfolding alongside a series of concurrent high-profile exploits and operational disruptions across global crypto platforms. As cybersecurity experts scramble to trace the movement of the pilfered capital, the latest attack has underscored ongoing vulnerabilities in account management, cross-chain bridging, and the escalating sophistication of international cybercriminal networks.

Anatomy of the $106 Million EU Heist

According to intelligence published by ZachXBT, the unnamed European Union entity experienced unauthorized outflows totaling more than $106 million from multiple centralized exchange accounts over the weekend. The perpetrator, described by the investigator as an "illicit actor," systematically drained the accounts, extracting the capital primarily in the form of widely used stablecoins: USD Coin (USDC) and Tether (USDT).

The choice of stablecoins in the initial phase of the theft presented an immediate tactical hurdle for the attacker. Because issuers of USDC and USDT possess the technical capability to freeze tokens associated with illicit activity, cybercriminals typically seek to divest from these assets rapidly to prevent administrative clawbacks or freezes.

Recognizing this vulnerability, the perpetrator initiated a swift and aggressive laundering campaign within 24 hours of the initial breach. ZachXBT tracked the stolen funds as they were rapidly funneled through a complex web of decentralized and cross-border mechanisms designed to obfuscate the transaction trail.

The laundering strategy relied heavily on instant exchange services—platforms that allow users to swap one digital asset for another with minimal identity verification requirements. Specifically, the investigator noted that funds were routed through services such as WellWallet and Kyrrex. Furthermore, portions of the capital were converted into privacy-centric cryptocurrency Monero (XMR) via platforms like Wagyu. Monero is frequently favored by malicious actors because its cryptographic architecture inherently shields transaction senders, recipients, and transferred amounts from public ledger visibility.

To complicate tracking efforts further, the attacker bridged assets across multiple distinct blockchains. To aid in global recovery and empower decentralized finance protocols to block tainted capital, ZachXBT published a comprehensive list of 11 Ethereum addresses directly tied to the laundering of the stolen funds.

Attribution and the North Korean Question

Despite the speed and complexity of the laundering operation, preliminary forensic analysis has offered clarity on one critical front: attribution. While major state-sponsored hacking syndicates frequently utilize multi-tiered laundering networks, ZachXBT stated with a "high degree of confidence" that the perpetrator behind the EU entity theft is not linked to the Lazarus Group.

Lazarus Group is an umbrella designation frequently attributed by international cybersecurity firms and law enforcement agencies to state-backed hackers operating out of North Korea. The conclusion that the Lazarus Group was not involved was derived from a careful analysis of specific laundering indicators and procedural footprints left behind by the attacker.

This distinction separates the $106 million EU exchange account breach from the catastrophic $6.4 billion Binance hack that occurred earlier in the week. In the Binance incident, the U.S. Federal Bureau of Investigation (FBI) formally attributed the massive exploit to TraderTraitor, a North Korean-linked hacking collective.

The contrasting profiles of these two incidents highlight the diverse threat landscape facing digital asset platforms, where both nimble independent cybercriminal cells and heavily resourced nation-state actors continue to exploit systemic weaknesses.

A Week of Unprecedented Security Crises

The timing of the European Union entity breach contributes to what security analysts are calling the most turbulent week in the history of cryptocurrency infrastructure. The sector has been battered by a relentless succession of high-profile security failures, structural disruptions, and emergency interventions.

The crisis began with the record-setting $6.4 billion Binance hack, an event that sent shockwaves through the global financial community. In that unprecedented breach, rapid coordination between the affected exchange and stablecoin issuers played a critical role in mitigating total losses. Tether moved within 37 minutes to freeze stolen USDT on the Ethereum network, while Circle successfully froze the entirety of the $823 million in stolen USDC associated with the exploit. According to data from blockchain analytics firm Elliptic, these swift administrative actions successfully locked up roughly 44% of the total stolen haul.

Despite these interventions, North Korean money launderers demonstrated remarkable agility, dispersing the remaining un-frozen funds across approximately 12,000 distinct wallets, creating a digital needle-in-a-haystack scenario for international investigators. It remains unclear whether any portion of the $106 million stolen from the European Union entity has been successfully frozen by stablecoin issuers or centralized platforms.

Compounding the industry’s distress, additional security incidents unfolded simultaneously. On the same day the details of the EU breach emerged, Brazilian exchange Mercado Bitcoin announced it was forced to halt customer withdrawals following a sophisticated $40 million hack targeting its infrastructure. Concurrently, BTCPay Server, a prominent open-source cryptocurrency payment processor, issued an urgent security advisory instructing merchants globally to temporarily switch off their servers amid escalating reports of targeted hot wallet attacks.

Implications for Centralized Exchanges and Custody

The string of high-profile thefts has reignited intense debate regarding the security posture of centralized exchanges, account management protocols, and institutional custody solutions. While decentralized finance (DeFi) protocols have historically accounted for the lion’s share of cryptocurrency exploits via smart contract vulnerabilities, the recent wave of attacks highlights ongoing risks associated with centralized account credentials, API key security, and insider threats or sophisticated social engineering.

For institutional investors, corporate treasuries, and high-net-worth individuals operating within the European Union and globally, the incident serves as a stark reminder of the perils of maintaining substantial digital asset reserves in hot wallets or insufficiently secured centralized exchange accounts. Cybersecurity experts emphasize the necessity of robust multi-factor authentication, hardware security modules (HSMs), institutional-grade multi-signature (multisig) custody frameworks, and continuous onchain monitoring to detect unauthorized account activity before funds can be withdrawn and laundered.

Furthermore, the incident underscores the ongoing regulatory and technological arms race between cybercriminals and blockchain forensics professionals. As privacy coins, instant exchanges, and cross-chain bridges continue to be exploited by illicit actors to launder nine-figure sums, regulatory pressure on privacy-enhancing technologies and unregulated cross-border swap services is widely expected to intensify. Law enforcement agencies, blockchain intelligence firms, and compliant exchange platforms face mounting pressure to forge tighter, real-time collaboration channels to intercept stolen capital before it vanishes into the privacy-shielded corridors of the cryptographic underground.