ZachXBT alleges cover-up as suspected crypto theft tops $133M

cryptonews11-03 16:43

Blockchain investigator ZachXBT has raised the estimated value of a suspected cryptocurrency theft involving an unidentified European entity to more than $133 million after tracing another $27 million...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2680459737?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-11-03 16:43","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2680459737","market":"fut","top_or_hot":-1,"title":"ZachXBT alleges cover-up as suspected crypto theft tops $133M","media":"cryptonews","content":"<div>\n<p>Blockchain investigator ZachXBT has raised the estimated value of a suspected cryptocurrency theft involving an unidentified European entity to more than $133 million after tracing another $27 million...</p>\n\n<a href=\"https://crypto.news/zachxbt-alleges-cover-up-as-suspected-crypto-theft-tops-133m/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>ZachXBT alleges cover-up as suspected crypto theft tops $133M</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nZachXBT alleges cover-up as suspected crypto theft tops $133M\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-11-03 16:43 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/zachxbt-alleges-cover-up-as-suspected-crypto-theft-tops-133m/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>Blockchain investigator ZachXBT has raised the estimated value of a suspected cryptocurrency theft involving an unidentified European entity to more than $133 million after tracing another $27 million...</p>\n\n<a href=\"https://crypto.news/zachxbt-alleges-cover-up-as-suspected-crypto-theft-tops-133m/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"TETH","symbol_name":"21Shares Ethereum ETF","start_time":0,"source_url":"https://crypto.news/zachxbt-alleges-cover-up-as-suspected-crypto-theft-tops-133m/","article_id":"2680459737","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/zachxbt-alleges-cover-up-as-suspected-crypto-theft-tops-133m/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2680459737","pubTimestamp":1793695412,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"Blockchain investigator ZachXBT has raised the estimated value of a suspected cryptocurrency theft involving an unidentified European entity to more than $133 million after tracing another $27 million in withdrawals from centralized exchanges.ZachXBT raised the estimated value of a suspected European crypto theft from $106 million to over $133 million after identifying another $27 million in withdrawals from centralized exchanges.The blockchain investigator suspects that a major Western European financial institution was compromised and accused the affected organization of concealing the incident.ZachXBT claimed that more than $30 million had already been laundered and could potentially have been frozen by European Union law enforcement authorities.The suspected attacker reportedly moved funds through Ethereum, instant cryptocurrency exchanges and Monero, while ZachXBT expressed confidence that North Korea’s Lazarus Group was not responsible.In a November 3 update, ZachXBT said the add","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"TETH":"21Shares Ethereum ETF","BKCH":"AdvisorShares Sabretooth ETF","BITW":"Bitwise 10 Crypto Index ETF","EPV":"ProShares UltraShort MSCI Europe","BLOK":"Amplify Transformational Data Sharing ETF","STCE":"Schwab Crypto Thematic ETF","HECO":"SPDR Galaxy Hedged Digital Asset Ecosystem ETF","ETQ":"T-Rex 2X Inverse Ether Daily Target ETF","ESK":"REX-Osprey ETH + Staking ETF","ETH":"低成本以太坊ETF-Grayscale","SETH":"1倍做空以太币期货ETF-Proshares","LFGY":"YieldMax Crypto Industry and Tech Portfolio Option Income ETF","TEKX":"SPDR Galaxy Transformative Tech Accelerators ETF","DAPP":"VanEck Digital Transformation ETF","CRPT":"First Trust SkyBridge Crypto Industry and Digital Economy ETF","BK4601":"加密货币现货ETF","GDLC":"Grayscale CoinDesk Crypto 5 ETF","DIME":"CoinShares Altcoins ETF","NCIQ":"HASHDEX NASDAQ CRYPTO INDEX US ETF","BITQ":"Bitwise Crypto Industry Innovators ETF","USDC":"USDATA Corp.","ETCO":"Grayscale Ethereum HIGH Income ETF"},"translate_title":"ZachXBT 指控掩盖涉嫌加密货币盗窃金额高达 1.33 亿美元","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"SETH":0.6,"EPV":0.62,"DIME":1.5,"BITW":1.5,"HECO":0.9,"ETH":1,"NCIQ":1.5,"STCE":1.5,"TETH":0.6,"GDLC":1.5,"TEKX":1.5,"BITQ":1.5,"ETQ":0.6,"CRPT":1.5,"ESK":0.6,"BLOK":0.9,"DAPP":1.5,"USDC":1,"BKCH":1.5,"LFGY":1.5,"ETCO":0.6},"content_text":"Blockchain investigator ZachXBT has raised the estimated value of a suspected cryptocurrency theft involving an unidentified European entity to more than $133 million after tracing another $27 million in withdrawals from centralized exchanges.\n\n\nSummary\n\n\n\nZachXBT raised the estimated value of a suspected European crypto theft from $106 million to over $133 million after identifying another $27 million in withdrawals from centralized exchanges.\nThe blockchain investigator suspects that a major Western European financial institution was compromised and accused the affected organization of concealing the incident.\nZachXBT claimed that more than $30 million had already been laundered and could potentially have been frozen by European Union law enforcement authorities.\nThe suspected attacker reportedly moved funds through Ethereum, instant cryptocurrency exchanges and Monero, while ZachXBT expressed confidence that North Korea’s Lazarus Group was not responsible.\n\n\n\nIn a November 3 update, ZachXBT said the additional transactions were connected to the same illicit actor identified in his earlier investigation, with some withdrawals taking place after he first disclosed the incident publicly.\nThe investigator now suspects that a major financial institution in Western Europe may have been compromised and accused the affected organization of concealing the incident.\nZachXBT questions the lack of disclosure after suspected theft\nThe investigation began with a November 2 community alert, when ZachXBT reported that an unidentified European entity was suspected of losing more than $106 million from several centralized exchange accounts on November 1.\nAt the time, he identified multiple wallet addresses associated with the withdrawals and published a transaction map showing how the suspected stolen assets had moved between wallets, exchanges and other cryptocurrency services.\nThe latest update added four more addresses to the investigation, bringing the number of publicly identified theft addresses across both disclosures to 15.\nThe investigator was particularly critical of the absence of an incident disclosure, claiming that more than $30 million had already been laundered and could potentially have been frozen by European Union law enforcement authorities.\nHow were the suspected $133 million in stolen funds moved?\nAccording to ZachXBT’s original findings, the attacker initially withdrew the suspected stolen assets in two dollar-pegged stablecoins, USD Coin (USDC) and Tether (USDT), before beginning a series of transactions intended to move the funds through different services.\nOver the following 24 hours, the wallets were used to swap USDC for Ethereum (ETH), with portions of the assets subsequently transferred to instant cryptocurrency exchanges, including WellWallet and Kyrrex.\nThe investigator identified another route involving Wagyu, where funds were converted into the privacy-focused cryptocurrency Monero (XMR).\nOther transactions involved bridging assets between blockchain networks, allowing the suspected attacker to move funds through several chains instead of keeping them on a single network.\nZachXBT said he was highly confident that the attacker was not North Korea’s Lazarus Group, citing several indicators from the laundering transactions that differed from patterns he associated with the hacking organization.\nIn a subsequent post on X, ZachXBT said the suspected attacker was French-speaking and had some on-chain connections to users of cybercrime forums.\nPrevious investigations have traced stolen funds through Monero\nThe use of Monero and instant exchanges resembles transaction routes documented in other cryptocurrency theft investigations, where attackers have exchanged stolen assets before moving them to new wallets.\nIn June, crypto.news previously reported that Tether froze $72 million in USDT after ZachXBT traced approximately $120.2 million through cryptocurrency services and transactions linked to Monero purchases.\nThe investigation identified movements through Tron, KuCoin, instant exchanges and NEAR Intents wallets before Tether blacklisted an address holding approximately 72.03 million USDT.\nMore recently, an October 20 investigation linked FreedomXMR inflows on Hyperliquid Core to suspected illicit activity.\nZachXBT estimated that more than 87% of the service’s incoming funds were associated with illicit sources, tracing over $20 million to ransomware payments, cryptocurrency exploits, malware and social engineering attacks.\nThe identified transactions included funds associated with security incidents involving DCENT Wallet, Fetch.ai, Axelar and online gambling platform Gamdom.\nSeparately, an October investigation into the Bybit laundering network described how ZachXBT infiltrated an alleged Chinese criminal operation that he claimed had processed more than $1 billion connected to North Korean hackers.\nDuring that investigation, he said he spent $349,700 posing as a customer to obtain transaction information and trace funds associated with the February 2025 Bybit hack.\nThe investigator subsequently shared evidence with private-sector researchers and law enforcement officials, while Tether froze 442,000 USDT connected to wallets identified during the operation.\n\n\n\n\n\n                Read more:\n            \n\n                Hyperliquid price prediction: Could HYPE fall to $60 after losing $85?","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.52.1","shortVersion":"4.52.1","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2680459737","isCrawlerRequest":true}