A major financial organization from Western Europe has fallen victim to a hack, but the incident has still not been publicly disclosed. It is estimated that the attacker withdrew more than $133 million from several accounts on centralized exchanges (CEX), and over $30 million of these funds have already passed through money-laundering schemes. For clients and investors, the key risk lies in the very fact of the cover-up: without official disclosure of the incident, the chances of recovering the money are rapidly dwindling.
The first signals of what was happening appeared on November 2, when independent on-chain detective ZachXBT drew attention to suspicious activity. According to his analysis, an unknown entity lost more than $106 million from several exchange accounts at once, and the funds were withdrawn in the stablecoins USDC and USDT.
How the attacker covered his tracks
Over the next 24 hours, the hacker actively converted USDC into ETH and transferred the coins to instant exchange services, including WellWallet and Kyrrex. Part of the funds passed through the Wagyu service with conversion into Monero (XMR) — a cryptocurrency whose transfers are virtually impossible to trace. Additionally, the money was moved through cross-chain bridges to other blockchains, which significantly complicates the investigation.
The identity of the criminal has not yet been established, but ZachXBT with high confidence ruled out the involvement of the North Korean hacking group Lazarus. This conclusion follows from several characteristic signs in the laundering scheme. Meanwhile, on November 3, the detective updated the data: he discovered more than $27 million in additional withdrawals from exchanges linked to the same perpetrator, and some of these operations took place after the first publication.
Why the speed of disclosure is critical
How important timely freezing of assets is was demonstrated by a June precedent: a fraudster himself complained to ZachXBT about the blocking of 5.73 BTC (about $475,000) on the Changelly platform. The detective traced the transactions and established that the coins were linked to thefts from US residents, including pensioners.
The criticism of the KYC procedure deserves special attention. According to ZachXBT, identity verification benefits only the attackers: when a company is hacked, management bears no responsibility for the theft of users' funds, and the collected data does not help in investigations. The cover-up of the incident in this case only exacerbates this problem.
Cryptalist analysis: Concealing a $133 million hack is not only a reputational but also a systemic regulatory risk for the entire European segment of digital assets, especially amid tightening MiCA requirements. The practice whereby the victim does not disclose the incident while the hacker freely converts funds into Monero and moves them through bridges demonstrates the weakness of rapid-freeze mechanisms and coordination between exchanges. For institutional investors, this is a signal to reconsider the assessment of counterparty risks at centralized platforms with opaque incident reporting.