www.bitquery.io EU Crypto Theft Estimated at $133M Amid Allegations of Cover-Up
Article Content
- •Estimated losses from the theft have risen to $133 million, with $27 million identified in new withdrawals.
- •The suspected attack involved a large financial institution in Western Europe, with allegations of a cover-up.
- •More than $30 million could have been laundered due to a lack of proper incident disclosure.
Blockchain investigator ZachXBT has raised the estimate of a suspected crypto theft from a European Union entity to over $133 million, up from an initial report of $106 million. The increase includes an additional $27 million in withdrawals identified from centralized exchanges, some occurring after the initial disclosure. ZachXBT theorizes that a large financial institution in Western Europe was exploited and that there is an ongoing cover-up of the incident. The lack of proper incident disclosure is believed to have allowed over $30 million to be laundered, which could have been frozen by EU law enforcement. As of November 2, approximately $78.3 million remained in wallets linked to the suspected attacker, with $62.98 million converted into 27,553 Ether (ETH) within a short timeframe. The attacker has been observed swapping funds into ETH and Monero (XMR) through various exchanges. The victim's identity and the allegations of a cover-up remain unverified.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Lazarus Group in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What exchanges were involved in the theft?
Is there a confirmed identity of the victim?
What actions can law enforcement take?
Continue Reading
PHP2Shell Vulnerabilities Exploited by AI-Driven Attackers Threat actors have exploited PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to target a government entity in Europe, gaining access to sensitive data within two hours of the initial breach. The attackers utilized AI tools for reconnaissance and post-exploitation activities, including accessing… 
Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…