ZachXBT Warns of Possible $133 Million Crypto Hack Involving European Financial Institution

Highlights:

• ZachXBT has linked over $133 million in suspicious crypto withdrawals to a possible theft involving a European institution.
• The investigator found another $27 million in withdrawals and suspects a major Western European financial institution.
• ZachXBT criticized delayed disclosure, warning that over $30 million moved through suspected laundering channels after the incident.

Blockchain investigator ZachXBT has linked more than $133 million in suspicious cryptocurrency withdrawals to a possible theft involving an unidentified European organization. The amount rose after he found another $27 million in withdrawals from centralized crypto exchanges. Some transfers took place even after he publicly warned about the incident.

In a November 3 Telegram update, ZachXBT said the latest withdrawals were connected to the same suspected attacker he had identified a day earlier. He believes a large financial institution in Western Europe may be the victim, but has not confirmed its identity.

ZachXBT Suspects European Institution Is Covering Up Crypto Breach, Says $30M Could Have Been Frozen

Blockchain investigator ZachXBT said he identified more than $27 million in additional suspicious withdrawals from centralized exchanges, bringing the total linked to a suspected… pic.twitter.com/zucFNIWQPz

— Wu Blockchain (@WuBlockchain) November 3, 2026

ZachXBT Links 15 Crypto Wallets to Suspicious Withdrawals

ZachXBT first reported the incident on November 2 after tracking more than $106 million in suspicious withdrawals from crypto exchanges on November 1. The suspected attacker withdrew the funds in USDC and USDT stablecoins.

In his latest investigation, ZachXBT identified four additional wallet addresses connected to the transfers, bringing the total to 15. He used blockchain transaction records to track funds moving across these wallets. However, the records do not reveal who controls them.

So far, ZachXBT has linked more than $133 million to the suspected theft, but authorities have not confirmed the actual losses. The affected institution has also not identified itself or explained how the suspected attacker accessed its exchange accounts.

ZachXBT Raises Questions About Delayed Security Disclosure

ZachXBT suspects the affected organization has kept the incident private. In his update, he wrote: “My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up.”

He also claimed that a lack of timely reporting allowed more than $30 million to be moved and laundered. According to the investigator, European Union law enforcement could potentially have frozen those assets if the suspected breach had been reported earlier. However, there is no public confirmation of a cover-up. Authorities have not verified the claimed losses or said whether they attempted to freeze the funds.

Suspected Attacker Moves Crypto Through Ether and Monero

In his November 2 alert, ZachXBT said the suspected attacker converted USDC into Ether (ETH) and transferred funds through crypto exchange services, including WellWallet and Kyrrex. The attacker also used Wagyu to swap some funds into Monero (XMR), a privacy-focused cryptocurrency that makes transactions harder to trace.

The attacker also transferred funds across several blockchain networks. Meanwhile, blockchain analytics firm Bitquery reported on November 2 that it had tracked $108.8 million in USDC withdrawals from three crypto exchanges. According to Bitquery, the attacker converted $62.98 million in stablecoins into 27,553 ETH within roughly four hours.

Bitquery also identified $78.3 million still held in Ethereum wallets linked to the suspected attacker at 13:47 UTC on November 2. Only $3.74 million remained in USDC that its issuer, Circle, could potentially freeze.

Meanwhile, ZachXBT said the transaction patterns did not match those he associates with North Korea’s Lazarus Group. However, he has not identified another suspect. The case remains unresolved, with no official confirmation of the suspected breach or the amount the affected organization may have lost.