Quick answer: In a suspected crypto theft, an unnamed EU-based entity lost more than $106 million from several centralized exchange accounts on Nov. 1, 2026, on-chain investigator ZachXBT said on Nov. 2. The attacker withdrew USDC and USDT, swapped into ETH and moved part of the funds into Monero. The victim and attack method remain undisclosed.
A $106 million crypto theft is the latest security shock in a brutal stretch for the industry. On-chain investigator ZachXBT said on Nov. 2, 2026, that an unnamed entity based in the European Union is suspected of losing more than $106 million from multiple centralized exchange accounts on Nov. 1, as reported by Crypto Briefing and The Defiant.
The alert landed only days after the $6.3 billion Binance hack. Once again, the money is moving fast, and part of it has already vanished into a privacy coin.
What happened in the $106 million crypto theft?
ZachXBT shared the case in a community alert on his Telegram channel, according to CoinLaw. He said the attacker withdrew the funds mainly as two stablecoins, USDC and USDT, from several exchange accounts tied to the victim.
In addition, he published 11 wallet addresses linked to the theft. All of them use the 0x format shared by Ethereum and other EVM chains. That gives exchanges and swap services one list to screen against.
However, the basics are still missing. ZachXBT did not name the entity. He also did not identify the exchanges that held the accounts. And nobody has explained how the attacker got into several accounts at once. CoinLaw also noted that no one has independently confirmed the loss so far.
How did the attacker launder the stolen funds?
Notably, the attacker did not wait. Within 24 hours of the withdrawals, the wallets made four kinds of moves, per ZachXBT’s alert as summarized by TechFlow:
- Swapping USDC for ETH at an aggressive pace.
- Sending funds to instant exchange services, including WellWallet and Kyrrex.
- Converting funds into Monero (XMR) through Wagyu.
- Bridging assets across several blockchains.
Still, the order matters. Circle can blacklist addresses that hold USDC, and Tether can freeze USDT. ETH has no issuer that can freeze it. So every dollar swapped out of a stablecoin leaves the reach of the companies best placed to stop it.
Meanwhile, Monero is the final escape hatch. It hides sender, receiver and amount, so public tracing gets much harder after that step. Wagyu describes itself as a cross-chain swap and bridge service that offers native Monero without identity checks, CoinLaw reported.
Can funds from the crypto theft still be frozen?
Partly. Any USDT still sitting in the flagged addresses remains within Tether’s freeze powers, which it used in a $344 million USDT freeze earlier this year, according to CoinLaw. Funds already converted into ETH or Monero are much harder to recover. In those cases, recovery usually depends on the platforms the money touches next.
Why does this crypto theft matter for markets?
First, size alone makes it notable. A $106 million loss would rank among the larger thefts of 2026, even if it is small next to Binance.
Even more important is the pattern. Attackers keep targeting accounts on centralized platforms rather than smart contracts. In recent days, we covered BTCPay Server hot wallets being swept, a DNS hijack on 12 DeFi sites and a Chainalysis data breach. As a result, regulators are reacting too. South Korea’s central bank just asked banks and brokers to stress-test a big exchange hack.
For traders, the direct price impact looks limited so far. The swaps into ETH are small next to daily Ethereum volume. Still, another large theft adds to the risk-off mood after Bitcoin’s worst October since 2014.
What should funds and companies on exchanges do now?
For example, security experts point to a few basics. Lock withdrawals to an allowlist of known addresses. Review API keys and remove withdrawal rights where they are not needed. Spread large balances across custody setups instead of leaving them on trading venues. Exchanges and swap desks can also block deposits from the 11 published addresses.
What to watch next
Three things will shape this story. First, whether the victim comes forward and explains the breach. Second, whether Tether or Circle freezes any remaining stablecoins. Third, whether WellWallet, Kyrrex or Wagyu say they held or rejected any of the deposits. We will update this coverage as new facts arrive.
EU Crypto Theft FAQ
Who lost $106 million in crypto?
An unnamed entity based in the European Union, according to ZachXBT’s Nov. 2, 2026 alert. As of Nov. 2, no one had publicly named the victim or the exchanges that held its accounts.
How was the $106 million stolen?
Nobody has disclosed the attack method yet. ZachXBT said the attacker withdrew USDC and USDT from multiple centralized exchange accounts on Nov. 1, 2026, which suggests account access rather than a smart-contract bug.
Where did the stolen crypto go?
The attacker swapped USDC for ETH, sent funds through instant exchanges WellWallet and Kyrrex, converted part into Monero via Wagyu, and bridged assets across chains, per ZachXBT.
Can the stolen funds be recovered?
Some may be. USDT still held in flagged addresses can be frozen by Tether, but funds converted to Monero are very hard to trace or recover.
Not financial advice. Details of this incident are still developing, so always DYOR.
