Eu 106m Crypto Theft

The money left through addresses the victim already trusted. We followed it into 229 wallets to see where it went, and how much can still be stopped.

$108.8M Left accounts at Kraken, Crypto.com and OKX in USDC for 15 wallets on 1 and 2 November, more than the $106M first reported.

Left accounts at Kraken, Crypto.com and OKX in USDC for 15 wallets on 1 and 2 November, more than the $106M first reported.

11 of 15 Wallets had been paid by these exchanges before the theft. They look like the victim's own.

Wallets had been paid by these exchanges before the theft. They look like the victim's own.

$78.3M Still sat on Ethereum in addresses tied to the thief at 13:47 UTC on 2 November, mostly as ETH.

Still sat on Ethereum in addresses tied to the thief at 13:47 UTC on 2 November, mostly as ETH.

27,553 ETH Bought through UniswapX in four hours with $62.98M of stablecoins. No freeze came.

Bought through UniswapX in four hours with $62.98M of stablecoins. No freeze came.

$28.00M Went to four addresses that were missing from the posted list of 11.

Went to four addresses that were missing from the posted list of 11.

$3.7M Was all that still sat in USDC, which Circle can freeze. A KuCoin deposit address took $8.12M.

Was all that still sat in USDC, which Circle can freeze. A KuCoin deposit address took $8.12M.

01 · What happened What happened in the $106M crypto theft

On Sunday, 1 November, a European crypto holder lost over $100 million in an apparent theft. The money left its accounts at Kraken, Crypto.com and OKX. It went out as USDC, a digital dollar, over 21 hours. Most of it went first to addresses those exchanges had paid before. Within minutes, it moved on to new ones nobody had seen before.

On Monday, a post by Officer's Notes said the on-chain sleuth ZachXBT had flagged a suspected theft of more than $106 million from an EU entity. The post listed 11 addresses. It said the thief was swapping USDC for ETH, sending money through instant exchanges and turning some of it into Monero, a privacy coin. A graph from the analytics firm TRM went with it.

Bitquery records every transfer on Ethereum , so we followed the money from those 11 addresses, and back to where it came from. We count $108.80M withdrawn to 15 wallets, four more than the list named. Most of it has not gone far. At 13:47 UTC on 2 November, $78.27M still sat in addresses we tie to the thief, mostly as ETH. We also found that eight of the 11 listed addresses look like the victim's own wallets, because the exchanges had paid them before the theft.

02 · The setup How the money got out of the exchanges

The exchanges paid 15 wallets. Eleven of them had been paid by the same exchanges before, two of them since May. They got 84% of the money. Whoever moved it on had the keys to those wallets too.

The other four were new that day and took $17.27M. The very first payments from OKX and from Kraken both went to new wallets. Many exchange accounts can lock withdrawals to a short list of approved addresses, called an allowlist. If the accounts used an allowlist, the thief was able to add to it. If they had none, the thief could send money anywhere.

From there the money split three ways. Most was swapped into ETH, some became DAI, a stablecoin with no freeze button, and the rest left through exchange deposits, bridges to other chains and instant swap services.

03 · The day Twenty-one hours of withdrawals

The first withdrawal left OKX at 12:25 UTC on Sunday. Kraken followed 44 minutes later and ended up paying 95% of the total. Withdrawals built up through the afternoon and peaked in the evening.

In the three hours to 23:00 UTC, $73.2M left, two thirds of the total. By 23:10 UTC, 98% was gone. The rest went out overnight, nearly all of it to one wallet, 0xd3c1…a7c1 . The final payment landed on Monday morning.

The money did not sit still. The median wait before the USDC moved on to a fresh wallet was three minutes, and ten of the 13 that got large payments passed them on within 15 minutes. One new wallet took 43 Kraken withdrawals in 91 minutes, each under $50k. That looks like the thief working around a limit on each withdrawal.

04 · The wallets Most wallets on the list look like the victim's

Eleven of the 15 have a history. The oldest, 0x730b…3992 , took its first Kraken withdrawal on 4 May. It took 48 more before the theft and paid the money on to other addresses, much as a business pays its suppliers. Another, 0x90f0…c557 , took $858k from Kraken in October and spent it within days.

They also paid each other before the theft. Three of them sent USDC to the oldest one over the summer. Two others paid the same outside addresses in October. One owner most likely ran them all.

Both sides used the same kind of wallet. Of the 15, 8 are Trust Wallet smart accounts, set up to pay their network fees in USDC, and so are 20 of the thief's addresses. Millions of people use Trust Wallet, and nothing here points to a flaw in the app. The shared setup fits one person or team handling both sets of keys.

Three of the 11 posted addresses were new on 1 November. The posted list also left out four addresses that took $28.00M between them. One of those, 0xe944…8cb9 , does appear in TRM's graph.

The thief likely had both the exchange logins and the keys to wallets the victim had used before. That points to a break-in on the owner's own devices or wallet setup, or to someone inside the victim's own team. The chain alone cannot tell those apart.

05 · The victim What the wallets say the victim

We could not name the victim. None of the 15 appears in our address labels , none has an ENS name, a readable wallet name, and no public post we found ties them to a company.

The owner has used Kraken since May, Crypto.com since October and OKX as well. Between 20 October and 1 November, two of the 15 also paid deposit addresses of a service that TRM's graph tags as Kyrrex, a European exchange. The owner likely had an account there too. The wallets swapped tokens on-chain and paid dozens of other addresses, often in round sums.

That looks like a trading or payments business run from everyday crypto wallets, rather than a fund that keeps its coins with a custody firm. We hold that view loosely. Kraken, which paid 178 of the withdrawals, can say for sure who owns the account.

06 · The swap Into ETH before anyone could freeze it

Circle, the company behind USDC, can freeze the coins at any address. ETH has no such switch. So the thief's first job was to swap.

Just before midnight UTC, a fresh wallet started selling stablecoins through UniswapX. That is an auction where market makers, the trading firms that quote prices, compete to fill your trade. A large order gets done fast and near the market price. Within four hours it had sold $62.98M of USDC and USDT for 27,553 ETH, $2,286 each.

Another branch of the theft swapped its USDC into DAI instead. Circle did not freeze any of the thief's USDC during the sale, or by our check on Monday. After the Binance hack last week, Tether and Circle froze more than $2 billion within hours. Here the swap ran for four hours with no freeze at all. We do not know whether anyone asked Circle to act.

07 · The money now Where the $108.8M is now

Most of the money has not left Ethereum. At our Monday snapshot, 72% of it sat in addresses we tie to the thief.

The ETH is in a few big piles. At the snapshot, three wallets held 22,785 ETH, three quarters of the thief's ETH. Until Monday afternoon, two of them had never sent anything. One wallet alone holds 4.14M DAI.

The piles have started to move. Just before our snapshot, one of those two wallets sent a small test payment to a new address. Six minutes later it sent 1,956 ETH to the same address. Another big wallet moved 900 ETH to an address the thief already used. Both moves stayed inside the thief's own wallets. At 14:22 UTC, the thief still held $77.8M.

The thief's addresses are already getting fake look-alike transfers from spammers, a trick known as address poisoning . Anyone can follow the stashes with the Bitquery MCP .

08 · The exits How money left the thief's hands

$30.5M has left so far, net of anything that came back.

The biggest single exit is a KuCoin deposit address that took $8.12M and swept it into KuCoin's own wallet. The same address took money from 175 other senders in a little over a day, and TRM's graph tags part of the flow as Kyrrex. So it is likely Kyrrex's pooled account at KuCoin. Some of the victim's own payments to Kyrrex in October ended up at the same KuCoin address.

LI.FI, a bridge and swap router, took $4.34M. Part of that went through one-time order wallets that TRM tags as Wagyu, a service that swaps crypto into Monero. The amounts match TRM's graph to the unit, but the Monero side is out of sight by design.

FixedFloat, an instant exchange that needs no account, took $1.32M. WellWallet took $250k. Smaller sums went to five more bridges. Another $12.91M went to addresses with no label. Several of those swap and pay out like over-the-counter desks. We saw the same pattern in the $110M TRON laundering circuit .

09 · Freeze What can still be frozen

Most of what the thief holds cannot be frozen by an issuer. ETH has no issuer, and DAI has no freeze function.

On Monday, 3.74M USDC still sat in the thief's wallets, nearly all of it in five of them, and Circle can freeze it. KuCoin and Kyrrex can say whose account the deposit address credited. FixedFloat and WellWallet can see who placed the orders they filled.

A 0.13 ETH payout from WellWallet gave the swap wallet its first ETH for network fees, so WellWallet can also see who ordered that payout. One wallet that moved $4.75 million into the thief's addresses is older than the rest. It has made small payments since December 2025, among them one in May to a Revolut deposit address. Revolut can tell who owns that address. The older wallet may belong to a helper rather than the thief. Our investigation team can take a case like this further.

10 · The claims Checking the claims

Most of the first report holds up on the chain.

11 · Lessons What this means for your exchange account

An allowlist protects you only as well as the wallets on it. If the same laptop or phone holds your exchange login and your wallet keys, one break-in can open both.

Keep big balances behind a hardware key, both for logging in and for the wallets on your allowlist. Turn on the waiting period that many exchanges offer for new addresses, so that nobody can add a wallet and cash out to it in the same hour. Watch your allowlisted wallets as closely as the account itself. Payments into a wallet you no longer use are a warning sign.

12 · Gaps What we could not see

We do not know how the thief got in. We read Ethereum only and checked the three exchanges' main wallets, so other chains, and other wallets at those same exchanges, could still add to the total.

Two of the 15, 0xd3c1…a7c1 and 0x3e6c…40f2 , link to the thief through a few steps rather than directly. On Monday morning, $400k from the first reached a thief wallet through two middle wallets. From the second, $3M went through the older wallet that once paid Revolut, then on to the thief. Without these two, the count would be $95.71M.

13 · The method How we traced the money

We started from the 11 posted addresses and the exchange wallets that paid them. Then we followed every large payment forward, skipping known services, and looked back for other addresses the same exchange wallets had paid. We checked each wallet's history and each balance at the same moment, so the money in and the money out add up.

We traced the Name.com DNS hijack and the b14g drain the same way last week. You can get the full history of the chain as files on the Bitquery Data Store, in the Ethereum dataset .

We read Ethereum only. Transfers and balances were both read at block 26,327,492, 13:47 UTC on 2 November. Later moves are not covered, apart from the stash moves to 14:22 UTC described in the text.

The total counts USDC that the main wallets of Kraken, Crypto.com and OKX paid to 15 addresses on 1 and 2 November. Other wallets at those exchanges, other exchanges and other chains were not searched.

Two of the 15 addresses link to the thief through a few steps rather than directly. Without them the total would be $95.71M.

A wallet counts as the thief's when most of what it received came from the theft. Contracts, busy services and 26 addresses with long histories count as outside parties. One older wallet that acted as a hub is counted in.

Held ETH is valued at $2,281, the price at the snapshot. Exits are net of money that came back to the thief from the same place, directly or through up to three wallets.

That 11 of the paid addresses belonged to the victim is our reading of their history. It is not confirmed by the victim or the exchanges.

Names of exchanges, bridges and services come from our address labels and from TRM's published graph, checked against on-chain behaviour.

14 · The record The addresses behind the theft

Watch the thief's wallets in plain English

Every transfer in this story comes from Bitquery's Ethereum data. The Bitquery MCP server puts that data behind an AI assistant, so you can ask where a wallet's money went, or which wallets an address has paid, without writing a query. The full history is also sold as files on the Bitquery Data Store, in the Ethereum dataset .

This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, or investment advice, and nothing in it is a recommendation to buy, sell or hold any token or asset, or to use or avoid any exchange, wallet, protocol or service.

The findings describe transactions and balances observed on Ethereum on 1 and 2 November 2026. Attributions come from on-chain behaviour; they may be incomplete or incorrect and may be revised as more data becomes available.

References to Kraken, Crypto.com, OKX, KuCoin, Kyrrex, Circle, Tether, Trust Wallet, Uniswap, LI.FI, Wagyu, FixedFloat, WellWallet, Bridgers, Rango, Chainflip, Harbor, MetaMask, Revolut, ZachXBT, TRM or any other named project, company or person describe what the public record shows and what those parties have said in public. They are not statements any party's intent, security practices, solvency or conduct, and nothing here asserts that any named party acted unlawfully or negligently. The victim is not named. The wallets that took the funds are described by their behaviour and attributed to nobody.

Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from reliance on this material. All trademarks and company names are the property of their respective owners.

Reported by Gaurav Agarwal for Bitquery Research, with AI tools; every figure was checked against the raw data.

Nothing shows that. The withdrawals came from one customer's accounts, and most of the money went to addresses those exchanges had paid before. The pattern fits a break-in on the customer's side.

We traced $108.80M in USDC taken from accounts at Kraken, Crypto.com and OKX on 1 and 2 November. The first report, citing ZachXBT, put the suspected loss at more than $106 million.

Where did the money go?

Most of it was swapped into ETH and still sat on Ethereum on 2 November. $30.5M had left through a KuCoin deposit address, bridges and instant exchanges, with one route into Monero.

Can the money be frozen or recovered?

Only a small part can be frozen by an issuer. $3.7M was still in USDC, which Circle can freeze. Exchanges and swap services that received funds can hold accounts or records with police.

The victim has not been named. ZachXBT described it as an EU entity. The wallets' history points to an owner that has used Kraken since May, most likely a business.

What is a withdrawal allowlist?

It is a setting that lets an account send crypto only to addresses you approved in advance. It blocks a thief who has your password, unless the thief also controls those addresses or can add new ones.

Run the investigation in minutes

Ask any question of the blockchain. Bitquery's AI Investigations agent traces funds, attributes wallets, and writes auditable reports across every major chain. Prefer to do it yourself? Connect the Bitquery MCP server to your AI assistant, pull the raw datasets , or query the chain directly with the Bitquery API .