EU entity loses over $106M as attacker funnels stablecoins into Monero

An organization based in the European Union may have had more than $106 million drained from several of its centralized exchange accounts. 

Reports state that the thief rapidly converted the stolen funds into Ether and then the privacy coin Monero. 

What company was $106 million taken from?

On-chain investigator ZachXBT has reported that an unnamed organization based in the European Union has had about $106 million drained from its accounts. 

ZachXBT’s work shows that most of the money was stolen as USDC and USDT, then swapped into Ether (ETH) almost immediately. From there, the money went through instant-swap sites called Kyrrex and WellWallet, which exist to convert one asset into another fast. 

The money was changed into Monero (XMR) at a service ZachXBT’s research calls Wagyu. And then finally, the loot was moved across different blockchains using cross-chain bridges.

Researchers can reconstruct the steps taken by the attacker because stablecoins and ETH sit on public ledgers. Monero, however, hides the details of the sender, receiver and the amount, making the trail effectively go dark once the funds arrive there.

Investigators have shared eleven addresses linked to the theft, but it remains unlikely that the money will be recovered. 

Why do freezes keep arriving too late? 

Due to the fact that stablecoins can be frozen by crypto exchanges, attackers treat the asset as a liability and race to convert them before issuers act. Cryptopolitan reported on one instance where roughly $6.3 billion was stolen from Binance, in what it called the largest hack in crypto history.

Circle reportedly froze about $1.1 billion USDC of the stolen funds, and Tether froze $1.567 billion in USDT, but by that time attackers had already swapped a chunk of the loot into Ether, which no issuer can freeze, holding billions in ETH and bitcoin out of reach.

Bitget experienced the same thing in September when roughly $387.5 million stolen from it was swapped into ETH. Circle and Tether were only able to blacklist a wallet labeled “Bitget Exploiter 8” and lock about $318,000 in stablecoins. 

In April, blockchain investigator ZachXBT criticized Circle after a hacker who stole $285 million in the Drift exploit moved about $232 million in USDC using Circle’s own cross-chain tool. The transfers took about six hours, and Circle never froze the funds.

If you're reading this, you’re already ahead. Stay there with our newsletter.