An EU entity may have lost $106 million from exchange accounts in a day, ZachXBT says, and some of the money is already flowing into Monero

An entity in the European Union may have lost more than $106 million from its accounts at multiple crypto exchanges on Sunday, according to the pseudonymous investigator ZachXBT, who posted the finding in a Telegram alert on Monday. CoinDesk and Decrypt reported the claim and noted that it has not been independently confirmed; ZachXBT did not name the victim, the exchanges involved, or how the attacker got in. "Entity" could mean a company, a trading firm or a fund.

The money was withdrawn as USDC and USDT, two dollar stablecoins whose issuers can freeze tokens. Over the following 24 hours, the attacker swapped the USDC into ether, pushed funds through instant-exchange services and converted some of it into Monero through a service called Wagyu, according to CoinDesk. Monero obscures transaction details, CoinDesk notes, and neither ether nor Monero can be frozen by a central issuer. ZachXBT published 11 wallet addresses tied to the suspected theft.

He said he could say "with a high degree of confidence" that the attacker is not the Lazarus Group, citing multiple laundering indicators, CoinDesk reported. The FBI has attributed the Binance theft of more than $6 billion to TraderTraitor, a group linked to Lazarus.

Decrypt compared it with the Binance case, where, per Elliptic, Tether froze stolen USDT on Ethereum in 37 minutes and Circle froze all $823 million of stolen USDC. It is unclear whether any of the EU entity's funds have been frozen.