{"investigation":{"slug":"unidentified-eu-entity-suspected-133m-multi-exchange-crypto-theft-november-2026","entity_name":"Unidentified EU Entity - Suspected $133M Multi-Exchange Crypto Theft (November 2026)","trust_score":35,"severity_base":null,"score_modifier":0,"confidence":0.55,"status":"published","content_type":"investigation","summary":"On-chain investigator ZachXBT reported that an unidentified Western European entity suffered suspected losses from crypto accounts held at multiple centralized exchanges, with the estimated total rising from roughly $106 million (reported November 1-2, 2026) to over $133 million by November 3, 2026, as additional withdrawals were identified. Independent blockchain analytics firm Bitquery traced roughly $108.8 million in USDC withdrawn from accounts at Kraken, Crypto.com, and OKX, with funds subsequently converted to Ether and then partly to Monero to obscure tracing. As of the reporting window, neither the victim entity nor the exchanges involved has publicly confirmed the loss or disclosed the victim's identity, and ZachXBT has alleged the entity may be concealing the breach rather than reporting it to EU regulators; the figures and attribution should be treated as preliminary and unconfirmed.","sections":[{"content":"On November 1-2, 2026, blockchain investigator ZachXBT reported that an unidentified entity based in the European Union appeared to have lost approximately $106 million from several centralized exchange accounts, with funds withdrawn as USDC and USDT. On November 3, 2026, ZachXBT raised the estimate to over $133 million after identifying an additional roughly $27 million in withdrawals from centralized exchanges, some of which reportedly occurred after his initial public alert. Multiple crypto news outlets, including Cointelegraph, Unchained Crypto, and crypto.news, reported the revised figure. The exact totals vary slightly across outlets (for example, Bitquery's independent count put USDC outflows at about $108.8 million), and all figures should be treated as provisional pending confirmation by the affected parties.","heading":"Initial Disclosure and Estimate Growth","sources":[{"url":"https://primexbt.com/news/eu-entity-suspected-of-losing-106-million-from-crypto-exchange-accounts-zachxbt/","name":"EU entity suspected of losing $106 million from crypto exchange accounts, ZachXBT says","type":"news_article","credibility":2},{"url":"https://unchainedcrypto.com/zachxbt-suspects-cover-up-as-tally-on-suspected-eu-theft-climbs-to-133-million/","name":"ZachXBT suspects cover-up as tally on suspected EU theft climbs to $133 million","type":"news_article","credibility":2},{"url":"https://crypto.news/zachxbt-alleges-cover-up-as-suspected-crypto-theft-tops-133m/","name":"ZachXBT alleges cover-up as suspected crypto theft tops $133M","type":"news_article","credibility":2}],"severity":"high"},{"content":"Independent blockchain analytics firm Bitquery reported tracing approximately $108.8 million in USDC withdrawn from accounts at three centralized exchanges: Kraken, Crypto.com, and OKX. According to Bitquery's analysis, roughly $102 million of the USDC came from Kraken accounts, with about $5.4 million from Crypto.com and approximately $660,000 from OKX. Bitquery further found that about $62.98 million of the stablecoins was converted into roughly 27,553 Ether within approximately four hours of withdrawal. Kraken issued a statement saying it was working with law enforcement in an effort to recover the funds; Crypto.com said it had taken measures to prevent associated funds from moving through its platform; OKX said it was reviewing the allegations. None of the three exchanges has confirmed the identity of the affected account holder or independently verified the total loss figure.","heading":"Exchange Accounts Involved and Tracing","sources":[{"url":"https://www.ledgerinsights.com/eu-institutions-suspected-133m-theft-was-via-ordinary-exchange-withdrawals-mostly-at-kraken/","name":"Capital markets - EU institutions suspected $133m theft was via ordinary exchange withdrawals, mostly at Kraken","type":"news_article","credibility":2},{"url":"https://ambcrypto.com/kraken-restricts-accounts-linked-to-suspected-133m-crypto-theft/","name":"Kraken restricts accounts linked to suspected $133m crypto theft","type":"news_article","credibility":2},{"url":"https://cryptobriefing.com/?p=406316","name":"Kraken, Crypto.com block funds linked to suspected $133M crypto theft: Report","type":"news_article","credibility":2}],"severity":"high"},{"content":"ZachXBT reported that stolen funds were converted from stablecoins into Ether and then, in part, into Monero (XMR), a privacy-focused cryptocurrency that substantially complicates on-chain tracing compared to transparent ledgers like Bitcoin or Ethereum. ZachXBT stated he was confident the laundering pattern did not match methods historically associated with North Korea's Lazarus Group, suggesting the involvement of a different, separately trackable threat actor or group. This is an investigator's assessment based on observed on-chain behavior rather than a confirmed law-enforcement attribution, and no individual or group has been named as a suspect.","heading":"Laundering Route and Attribution","sources":[{"url":"https://www.altcoinbuzz.io/zachxbt-traces-106m-suspected-theft-through-eth-and-monero","name":"ZachXBT traces $106M suspected theft through ETH and Monero","type":"news_article","credibility":2},{"url":"https://www.gncrypto.news/news/zachxbt-raises-suspected-eu-crypto-theft-estimate-above-133m/","name":"ZachXBT lifts suspected EU crypto theft estimate above $133M","type":"news_article","credibility":2}],"severity":"high"},{"content":"ZachXBT has alleged that the affected EU entity is concealing the breach rather than disclosing it to EU authorities, raising questions about whether a regulated entity subject to incident-reporting obligations such as the EU's Digital Operational Resilience Act (DORA) may be involved. As of the reporting window in early November 2026, no victim has been named, and neither the entity nor any exchange has publicly confirmed the loss, its cause, or its magnitude. This section should be read as describing an allegation by a third-party investigator, not a confirmed finding. The incident remains a developing, unconfirmed investigation, and figures, attribution, and the identity of the victim may change as further information emerges.","heading":"Alleged Cover-Up and Unconfirmed Status","sources":[{"url":"https://www.cryptopolitan.com/zachxbt-accuse-european-institution-cover-up/","name":"LATEST NEWS - ZachXBT accuses European institution of cover-up","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/zachxbt-eu-crypto-theft-133m-alleged-cover-up","name":"Cointelegraph - ZachXBT EU crypto theft $133M alleged cover-up","type":"news_article","credibility":1}],"severity":"medium"}],"timeline":[{"date":"2026-11","event":"ZachXBT first publicly flags suspected losses of approximately $106 million from an unidentified EU entity's centralized exchange accounts, with funds withdrawn as USDC/USDT.","source":"PrimeXBT News","source_url":"https://primexbt.com/news/eu-entity-suspected-of-losing-106-million-from-crypto-exchange-accounts-zachxbt/","date_original":"2026-11-01"},{"date":"2026-11","event":"Approximately $108.8 million in USDC is withdrawn from accounts at Kraken, Crypto.com, and OKX, according to Bitquery's on-chain tracing; about $62.98 million is converted into roughly 27,553 ETH within about four hours.","source":"Ledger Insights","source_url":"https://www.ledgerinsights.com/eu-institutions-suspected-133m-theft-was-via-ordinary-exchange-withdrawals-mostly-at-kraken/","date_original":"2026-11-01"},{"date":"2026-11","event":"ZachXBT raises the suspected loss estimate to over $133 million after identifying an additional approximately $27 million in exchange withdrawals.","source":"Unchained Crypto","source_url":"https://unchainedcrypto.com/zachxbt-suspects-cover-up-as-tally-on-suspected-eu-theft-climbs-to-133-million/","date_original":"2026-11-03"},{"date":"2026-11","event":"Kraken restricts/freezes accounts linked to the suspected theft and states it is working with law enforcement; Crypto.com says it has taken measures to block associated funds; OKX says it is reviewing the allegations.","source":"AMBCrypto","source_url":"https://ambcrypto.com/kraken-restricts-accounts-linked-to-suspected-133m-crypto-theft/"},{"date":"2026-11","event":"ZachXBT alleges the affected EU entity is concealing the breach rather than reporting it to EU authorities; the victim remains unnamed and unconfirmed.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/zachxbt-accuse-european-institution-cover-up/"}],"sources_used":[{"url":"https://primexbt.com/news/eu-entity-suspected-of-losing-106-million-from-crypto-exchange-accounts-zachxbt/","name":"EU entity suspected of losing $106 million from crypto exchange accounts, ZachXBT says","type":"news_article","credibility":2},{"url":"https://unchainedcrypto.com/zachxbt-suspects-cover-up-as-tally-on-suspected-eu-theft-climbs-to-133-million/","name":"ZachXBT suspects cover-up as tally on suspected EU theft climbs to $133 million","type":"news_article","credibility":2},{"url":"https://www.altcoinbuzz.io/zachxbt-traces-106m-suspected-theft-through-eth-and-monero","name":"ZachXBT traces $106M suspected theft through ETH and Monero","type":"news_article","credibility":2},{"url":"https://www.ledgerinsights.com/eu-institutions-suspected-133m-theft-was-via-ordinary-exchange-withdrawals-mostly-at-kraken/","name":"Capital markets - EU institutions suspected $133m theft was via ordinary exchange withdrawals, mostly at Kraken","type":"news_article","credibility":2},{"url":"https://ambcrypto.com/kraken-restricts-accounts-linked-to-suspected-133m-crypto-theft/","name":"Kraken restricts accounts linked to suspected $133m crypto theft","type":"news_article","credibility":2},{"url":"https://cryptobriefing.com/?p=406316","name":"Kraken, Crypto.com block funds linked to suspected $133M crypto theft: Report","type":"news_article","credibility":2},{"url":"https://crypto.news/zachxbt-alleges-cover-up-as-suspected-crypto-theft-tops-133m/","name":"ZachXBT alleges cover-up as suspected crypto theft tops $133M","type":"news_article","credibility":2},{"url":"https://www.gncrypto.news/news/zachxbt-raises-suspected-eu-crypto-theft-estimate-above-133m/","name":"ZachXBT lifts suspected EU crypto theft estimate above $133M","type":"news_article","credibility":2},{"url":"https://www.cryptopolitan.com/zachxbt-accuse-european-institution-cover-up/","name":"LATEST NEWS - ZachXBT accuses European institution of cover-up","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/zachxbt-eu-crypto-theft-133m-alleged-cover-up","name":"Cointelegraph - ZachXBT EU crypto theft $133M alleged cover-up","type":"news_article","credibility":1}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-11-06T20:12:28.766347+00:00","updated_at":"2026-11-06T20:12:37.854+00:00"},"source_quality":{"total":10,"tier1":0,"tier2":1,"tier3":0,"unrated":9},"follower_count":null,"content_updated_at":"2026-11-06T20:12:29.139Z","last_fact_checked_at":null,"fact_check_next_allowed_at":null,"update_next_allowed_at":null}