In this article6 sections
An unidentified attacker drained more than $106 million from accounts held across several centralized cryptocurrency exchanges on November 1, 2026, according to pseudonymous blockchain investigator ZachXBT, as reported by AMBCrypto. The suspected target was a European Union-based entity, which has not publicly confirmed the theft.
The stolen assets reportedly included Circle’s USDC and Tether’s USDT. AMBCrypto reported that the funds were then moved through a laundering sequence designed to frustrate tracing and recovery.
Also read: USDC takes 56% of euro stablecoin trading as MiCA curbs USDT
Key facts
- The suspected theft exceeded $106 million and was linked to accounts at multiple centralized exchanges.
- ZachXBT dated the drain to November 1, 2026, and said the EU entity has not confirmed it.
- The attacker swapped USDC and USDT into Ethereum, then moved ETH to instant exchanges including WellWallet and Kyrrex.
- ETH was subsequently converted into Monero, a privacy-focused cryptocurrency.
- ZachXBT said with high confidence that North Korea’s Lazarus Group was not behind the operation, citing multiple laundering indicators.
How the funds were moved
The laundering followed a layered pattern. Stablecoin balances were first converted into ETH, consolidating value into a single liquid asset. The ETH was then sent to instant exchange services, WellWallet and Kyrrex among them, which can convert funds quickly.
From there, the assets were turned into Monero. Because Monero conceals the sender, recipient and transaction amount, investigators face a harder task in tracing the money. The suspected hacker also bridged assets across several blockchain networks, adding further complexity.
Each step raises the cost and time of recovery. Stablecoins issued by Circle and Tether can in principle be frozen at the issuer level, but conversion into ETH removes that option, and conversion into Monero removes most on-chain visibility.
Why Lazarus was ruled out
The scale of the incident and the use of privacy coins might have pointed toward North Korea-linked actors, who have a documented history of large crypto thefts. ZachXBT instead said the opposite. He stated that while the actor remains unidentified, he could say with a high degree of confidence that it was not the Lazarus Group, based on multiple laundering indicators.
The distinction matters for attribution. Sanctions and law-enforcement responses often hinge on whether a state-linked group is suspected, and an assessment pointing away from Lazarus changes the expected shape of any follow-up.
The MiCA backdrop
The report comes as EU stablecoin rules take hold. The European Banking Authority recognized USDC as the EU’s first major e-money token under MiCA. Separately, the European Securities and Markets Authority has told national regulators to restrict services involving non-MiCA-compliant stablecoins to sell-only, conversion, transfer and withdrawal functions, with continued services subject to strict supervision.
For exchanges operating in the bloc, that framework shapes how stablecoin flows are monitored, converted and reported, even as the suspected theft remains unconfirmed by the entity involved.
Why it matters
The case shows how quickly stolen stablecoins can be converted into assets with weaker tracing and fewer freeze mechanisms. It also puts pressure on centralized exchanges, which held the affected accounts, to account for how large balances moved out. For EU users and platforms, it arrives as MiCA compliance obligations tighten around the stablecoins at the centre of the alleged laundering.
What to watch
The next concrete development is whether the EU entity publicly confirms the theft. Exchange and issuer responses, along with any further tracing updates from ZachXBT, will indicate whether any of the funds can be recovered.
Reported by AMBCrypto.
Source: AMBCrypto