ZachXBT: EU entity may have lost over $106M in centralized exchange theft
In brief
- EU-based entity may have lost over $106 million across several centralized exchange accounts.
- ZachXBT, an on-chain investigator, brought the incident to public attention.
- Funds moved from USDC and USDT into ETH, then into Monero and across bridges.
- Victim identity and method of compromise remain undisclosed.
- Eleven addresses tied to the incident have been publicly identified.
How the funds moved
The attacker mainly withdrew the funds as USDC and USDT, according to ZachXBT's tracing as reported by Crypto Briefing. Those stablecoins were then swapped into ETH, Ethereum's native token.
It didn't stop there. The funds passed through instant exchange services (including Kyrrex and WellWallet) before being converted into Monero, with the research pointing to Wagyu as the venue for that conversion. After the Monero step, the money was sent through cross-chain bridges.
Kyrrex, WellWallet and Wagyu appear in the tracing only as services the funds moved through.
Eleven addresses tied to the incident have been publicly identified.
Why the Monero step matters
Monero (XMR) is a privacy-focused cryptocurrency that hides transaction details most public blockchains leave on display. That's a big deal for anyone trying to follow stolen money.
The research described the conversion to Monero and the bridge routing as making recovery complex and challenging for investigators. Put simply, the trail ran from stablecoins withdrawn off exchange accounts, through ETH, and into an asset that's designed to hide transaction details, before being routed across bridges.
What's still unknown
Very little is public about the victim. All that's known is that the entity is based in the EU, and its name hasn't been released.
The method of compromise also remains undisclosed. No explanation has been made public of how the attacker reached multiple exchange accounts, and the figure of more than $106 million is still described as a possible loss rather than a confirmed one.
So who was hit, and how did the attacker get in? Neither question has a public answer yet.
Frequently asked questions
How did the attacker move the stolen funds?
According to ZachXBT's tracing, the attacker mainly withdrew the funds as USDC and USDT and swapped them into ETH. The funds then passed through instant exchange services, including Kyrrex and WellWallet, were converted into Monero (with the research pointing to Wagyu as the venue) and were then sent through cross-chain bridges.
Why is recovering the funds difficult?
Monero is a privacy-focused cryptocurrency that hides transaction details most public blockchains display. The research described the conversion to Monero and the routing through cross-chain bridges as making recovery complex and challenging for investigators.
Who was the victim of the $106 million theft?
The victim hasn't been named. The only publicly known detail is that the entity is based in the European Union, and how the attacker reached its exchange accounts hasn't been disclosed either.
