Mystery $106M crypto theft hits unnamed EU entity, laundered to Monero

On-chain investigator ZachXBT flagged on November 2, 2026 that an unidentified European Union-based entity lost more than $106 million from accounts held across several centralised exchanges on Sunday, November 1. Funds exited as USDC and USDT, were swapped into 27,553 ETH (~$62.97 million per Lookonchain), run through instant-exchange services WellWallet and Kyrrex, converted to Monero (XMR) via Wagyu, and bridged across multiple blockchains. ZachXBT published 11 Ethereum addresses tied to the operation. Primary source: ZachXBT's Telegram community alert, Nov 2. Coverage: Decrypt.

What happened

ZachXBT's alert describes the account draws as CEX-side — accounts held at centralised exchanges, not self-custody wallets. The investigator did not name the EU entity, the exchanges, or disclose how the accounts were compromised. API-key theft, insider access and credential phishing all remain on the table publicly; the alert specifies none.

What is on-chain is the laundering trail. The attacker first withdrew the stolen balances as USDC and USDT, then swapped the USDC on-chain into 27,553 ETH worth about $62.97 million at the time of the swap (Lookonchain tracking). From there, the ETH flowed into WellWallet and Kyrrex — automated custody-free swap services — and ultimately into Wagyu, where it was converted into Monero. Once in XMR, the public trail ends.

ZachXBT said he could "with a high degree of confidence" exclude the Lazarus Group as the perpetrator, citing laundering indicators specific to this operation. He has not published those indicators in full.

Mechanism — the WellWallet / Kyrrex / Wagyu loop

The three services named by ZachXBT share a profile. WellWallet and Kyrrex operate as instant exchangers — users send one asset to a deposit address and receive a different asset at a quoted rate, without KYC-light at the small-ticket end. Wagyu is one of the handful of pipelines that reliably converts major L1 assets into Monero in volume; by design, XMR's ring-signature and stealth-address construction makes the chain untraceable at a public-explorer level.

In practice, the pattern is a well-worn one: liquid stablecoin → ETH as a bridge asset → multiple small-ticket swaps into XMR, spread across hops. The 11 Ethereum addresses ZachXBT published cover the on-chain portion; after Wagyu, correlating a sender in ETH to a receiver in XMR requires a side-channel.

Numbers

• Amount stolen: more than $106 million
• Portion observed on-chain in ETH: 27,553 ETH ≈ $62.97 million
• Addresses published by ZachXBT: 11 Ethereum addresses
• Date of theft: Nov 1, 2026; disclosure Nov 2
• Named laundering services: WellWallet, Kyrrex, Wagyu
• Lazarus attribution: ruled out by ZachXBT "with a high degree of confidence"
• Freezes to date: not disclosed — article notes it's unclear whether any of these funds have been frozen
• Source: ZachXBT Telegram alert (via Decrypt); Lookonchain for the ETH tracking

What to watch

1. Which centralised exchanges acknowledge they held some of the drained accounts, and in what proportions. The absence of a named victim entity is unusual for a nine-figure theft.
2. Whether any exchange publishes a freeze figure on the 11 ETH addresses ZachXBT shared. As of Nov 2, no freeze had been announced.
3. The attribution path. ZachXBT ruled out Lazarus. Candidate groups with the laundering fingerprints of this operation — ETH-first routing, multi-hop through Kyrrex/WellWallet, Wagyu XMR exit — are a smaller set.
4. Whether the targeted entity is a custodian, a fund, or an exchange's own treasury. Each raises different disclosure obligations under EU regulation, including MiCA Article 94 market-abuse disclosures and GDPR breach notifications where client data was touched.
5. Wagyu's response — the service has been named in multiple post-sanctions laundering reports in 2026 and could become a target for a formal OFAC designation under the pattern.

Context

This is at least the fourth nine-figure incident on CEX-held balances in 2026, and the second involving a direct account-drain rather than a protocol exploit. The pattern — stablecoin withdrawal → ETH consolidation → XMR exit — mirrors the laundering template that followed the DMM Bitcoin drain in 2024 and the WazirX multisig compromise. The specific pipeline through Wagyu to XMR has been documented in Elliptic's 2026 ransomware report as a growing exit route for post-sanctions laundering.

The theft also lands days after the $6.3 billion Binance hack attributed to North Korea's TraderTraitor. ZachXBT's explicit exclusion of Lazarus here draws a line between the two events; the question is who else at this scale is operating against CEX accounts in the EU, and how an entity holding over $100 million across multiple exchange accounts has not yet been publicly named three days after the drain.