ZachXBT accuses Western European institution of hiding $133M crypto theft

Blockchain investigator ZachXBT noted Tuesday that the still undisclosed crypto loss at an unnamed Western European institution has climbed past $133 million, up from the $106 million figure he cited one day earlier.

ZachXBT, who has previously forced disclosures after going public with crypto breaches, is now alleging that the affected EU entity is concealing the breach rather than reporting it to EU authorities.

Is an EU bank hiding a crypto hack?

ZachXBT wrote on his Telegram channel early Tuesday that “My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up.” 

The blockchain investigator noted that the loss estimate is now up to $133 million after another $27 million in withdrawals were processed through centralized exchanges. ZachXBT also noted that the withdrawals have continued even after his initial Monday disclosure.

Despite multiple flags of the incident, the victim has gone unnamed. The cover-up claim has not been independently verified either. 

ZachXBT did not suspect North Korea’s Lazarus Group involvement, noting that the laundering pattern did not resemble routes used by the notorious unit implicated in many of the largest breaches to hit the crypto industry.

Notably, ZachXBT noted that more than $30 million of the funds suspected of being stolen would have fallen within the EU’s freeze net if the incident had been reported. 

Three exchanges drained in a day

Analytics firm Bitquery tracked $108.8 million linked to the incident on-chain, citing transfers that started Sunday, November 1, from Kraken, Crypto.com and OKX accounts and over roughly 21 hours.

Bitquery noted that most of the money moved as USDC to 15 wallets, 11 of which those same exchanges had paid before the theft. 

That detail led Bitquery to conclude the attacker held the victim’s keys and exchange logins. The working theory is that the attacker has compromised the owner’s devices, or at least someone on the victim’s team. 

Eight of the compromised wallets were Trust Wallet smart accounts. Bitquery has stressed that the incident does not indicate a flaw in the Trust Wallet app.

After the theft, the funds were quickly moved from freezable to unfreezable assets. They exchanged roughly $62.98 million in stablecoins into 27,553 ETH through UniswapX over about four hours. 

From there, the funds were routed into Monero (XMR) and across bridges. 

About $78.3 million still sat on Ethereum in attacker-linked wallets as of 13:47 UTC on November 2, Bitquery said. The firm said the attacker’s wallet still holds $3.74 million in USDC. That’s money that Circle can still freeze.

Why a bank victim would land differently

ZachXBT’s theory points at a category of firm that only recently joined the market. European banks spent 2026 moving into crypto under the bloc’s Markets in Crypto-Assets rules, and lenders now make up close to 23% of the crypto-asset service providers on the EU’s MiCA register as of September. 

Deutsche Bank, Germany’s largest lender, was targeting MiCA approval for digital-asset custody.

Cryptopolitan’s earlier report on the $106 million drain noted the same pattern across the Binance and Bitget hacks: attackers convert stablecoins into Ether and privacy coins before Circle or Tether can act.

The disclosure question

The cover-up accusation matters most if the victim is a financial entity. Under the EU’s Digital Operational Resilience Act (DORA), in force since January 17, 2025, financial firms including crypto-asset service providers must flag and report major ICT-related incidents to supervisors through a first alert, a follow-up update and a closing report, according to France’s markets regulator, the AMF.

ZachXBT’s point is that the delay carried a direct cost. Without disclosure, he argues, roughly $30 million flowed out of reach that authorities could have locked. 

Whether any DORA-covered entity is involved is unconfirmed, and no regulator has named a victim.

The smartest crypto minds already read our newsletter. Want in? Join them.