The revised estimate follows ZachXBT’s initial disclosure on November 2 that more than $106 million had been withdrawn from exchange accounts linked to the victim. He said some of the additional withdrawals occurred after his first public warning, while the attacker continued converting and moving assets through exchanges, bridges and privacy-focused services.
The identity of the victim has not been confirmed. ZachXBT said his working theory is that a large financial institution in Western Europe was compromised, but that claim and his allegation that the incident is being concealed remain unverified.
How much of the $133 million can be independently traced?
Separate blockchain analysis by Bitquery traced $108.8 million in USDC leaving accounts at Kraken, Crypto.com and OKX over approximately 21 hours on November 1 and 2. Its analysis covered Ethereum activity and therefore does not account for every transaction included in ZachXBT’s broader $133 million estimate.
Bitquery found that $62.98 million in stablecoins was converted into 27,553 ETH through UniswapX within roughly four hours. At its November 2 snapshot, approximately $78.3 million remained in Ethereum addresses linked to the suspected attacker, while about $30.5 million had already exited the tracked wallets through exchanges, bridges and other services.
Only around $3.74 million remained in USDC at that point, leaving a relatively small portion that Circle could directly immobilize through its blacklist function.
The distinction matters because ZachXBT’s latest figure remains an investigator-attributed estimate rather than a loss total confirmed by the victim, the exchanges or law enforcement.
Investor Takeaway
The incident shows how quickly the recoverable portion of a stablecoin theft can shrink. Once USDC is converted into ETH, bridged or exchanged for privacy-focused assets, issuers lose the direct freezing mechanism available while funds remain in centralized stablecoins.
Why did the window for freezing funds close so quickly?
ZachXBT argues that more than $30 million could have been stopped if the incident had been disclosed and escalated earlier to exchanges and European law enforcement. That conclusion has not been independently established, but the transaction sequence shows that substantial amounts moved away from immediately freezeable assets within hours.
Bitquery found that several withdrawals were forwarded to new addresses within minutes. The funds were then divided between ETH purchases, DAI, cross-chain routes, exchange deposits and services associated with conversions into Monero.
The pattern resembles a recurring challenge in major crypto thefts: investigators and issuers have a limited period to intervene before stablecoins are converted into assets without centralized freeze controls. FinanceFeeds recently examined the same dynamic after Tether and Circle froze billions of dollars linked to the Binance breach, while other assets had already moved beyond those controls.
ZachXBT previously criticized Circle over what he described as delayed or absent freezes across multiple illicit-fund cases. Those allegations illustrate the tension between rapid intervention and the legal and evidentiary requirements imposed on centralized issuers.
Investor Takeaway
Recovery depends increasingly on coordination speed. Stablecoin issuers may control a freeze function, but that protection becomes substantially less useful once stolen assets are converted, bridged or deposited into services that require separate intervention.
What have the exchanges said about the incident?
Crypto.com said it was aware of the report and had taken action to prevent funds associated with the third-party incident from moving through its platform. The company said its own systems remained operational and customer funds were secure.
There is currently no evidence that Kraken, Crypto.com or OKX themselves were hacked. Bitquery’s analysis instead suggests that the attacker accessed accounts belonging to a customer and may also have obtained control over wallets previously used by that customer.
Eleven of the 15 Ethereum addresses identified by Bitquery had previously received funds from the same exchanges, suggesting that many were established withdrawal destinations rather than newly created attacker wallets. That could indicate compromise extending beyond exchange credentials to the victim’s own wallet environment, although the blockchain data cannot determine how access was obtained.
The situation differs from incidents where exchange infrastructure itself is breached. FinanceFeeds recently reported how investigators traced $93 million linked to thefts affecting Ledger users, another case in which rapid movement across stablecoins, exchanges and other networks complicated recovery.
What remains unknown?
The victim has not identified itself, no law-enforcement agency has publicly confirmed ZachXBT’s description of a Western European financial institution, and the method of compromise remains unclear.
ZachXBT also said the laundering behavior does not resemble patterns typically associated with North Korea’s Lazarus Group. That assessment narrows one possibility but does not identify the attacker.
The next important developments will be confirmation of the victim, updated tracing of the additional $27 million, disclosure of any frozen or recovered assets and evidence explaining how multiple exchange accounts and associated wallets were accessed.
Investor Takeaway
The $133 million figure should remain attributed to ZachXBT until additional tracing or an official disclosure confirms it. For now, the stronger independently documented figure is Bitquery’s $108.8 million of Ethereum withdrawals, with the gap likely to be a central focus of further investigation.