On-chain analysis has revealed the probable theft of funds totaling over $106 million in USDC and USDT stablecoins. The funds were withdrawn from accounts linked to an unnamed European organization across several centralized exchanges. The incident is dated November 1.
Over the following 24 hours, the suspected thief followed a well-established money-laundering scheme: actively converting USDC to ETH, running the assets through instant exchange services, including WellWallet and Kyrrex, then transferring them to Monero (XMR) via Wagyu and distributing them across different blockchains. This tactic makes it difficult to trace the final recipient of the funds and is typical of attempts to cover transaction trails.
The nature and sequence of the laundering actions allowed on-chain researchers to rule out with a high degree of confidence the involvement of the North Korean Lazarus Group in the attack. This is an important marker: Lazarus methods usually feature more sophisticated infrastructure and specific patterns that are not observed here.
The incident once again demonstrates the vulnerability of large organizational accounts on centralized platforms and the speed with which malicious actors are able to convert stablecoins into privacy assets. Conversion to Monero through intermediary exchangers remains one of the most sought-after tools for concealing the origin of funds.
Cryptalist analysis: The case confirms a sustained trend toward the use of privacy coins and instant exchange chains as the final link in laundering large sums in stablecoins. For institutional holders, this is a signal to strengthen control over exchange accounts and monitor anomalous USDC-to-ETH conversions in real time. The stablecoin market remains a priority target, and the speed of withdrawing funds into XMR significantly reduces the chances of recovering them.