EU entity loses $106M in USDC and USDT as attacker races stolen stablecoins into Monero
- An unnamed EU-based entity may have lost more than $106 million across several centralized exchange accounts.
- The attacker converted USDC and USDT into Ether, then Monero.
- It is the latest sign that attackers now convert freezable assets faster than issuers can act.
An organization based in the European Union may have had more than $106 million drained from several of its centralized exchange accounts.
Reports state that the thief rapidly converted the stolen funds into Ether and then the privacy coin Monero.
What company was $106 million taken from?
On-chain investigator ZachXBT has reported that an unnamed organization based in the European Union has had about $106 million drained from its accounts.
ZachXBT’s work shows that most of the money was stolen as USDC and USDT, then swapped into Ether (ETH) almost immediately. From there, the money went through instant-swap sites called Kyrrex and WellWallet, which exist to convert one asset into another fast.
The money was changed into Monero (XMR) at a service ZachXBT’s research calls Wagyu. And then finally, the loot was moved across different blockchains using cross-chain bridges.
Researchers can reconstruct the steps taken by the attacker because stablecoins and ETH sit on public ledgers. Monero, however, hides the details of the sender, receiver and the amount, making the trail effectively go dark once the funds arrive there.
Investigators have shared eleven addresses linked to the theft, but it remains unlikely that the money will be recovered.
Why do freezes keep arriving too late?
Due to the fact that stablecoins can be frozen by crypto exchanges, attackers treat the asset as a liability and race to convert them before issuers act. Cryptopolitan reported on one instance where roughly $6.3 billion was stolen from Binance, in what it called the largest hack in crypto history.
Circle reportedly froze about $1.1 billion USDC of the stolen funds, and Tether froze $1.567 billion in USDT, but by that time attackers had already swapped a chunk of the loot into Ether, which no issuer can freeze, holding billions in ETH and bitcoin out of reach.
Bitget experienced the same thing in September when roughly $387.5 million stolen from it was swapped into ETH. Circle and Tether were only able to blacklist a wallet labeled “Bitget Exploiter 8” and lock about $318,000 in stablecoins.
In April, blockchain investigator ZachXBT criticized Circle after a hacker who stole $285 million in the Drift exploit moved about $232 million in USDC using Circle’s own cross-chain tool. The transfers took about six hours, and Circle never froze the funds.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.
FAQs
How much was stolen and who was the victim?
More than $106 million was taken across multiple centralized exchange accounts held by an entity based in the European Union. The victim has not been publicly named, and the method of compromise has not been disclosed.
Where did the stolen funds end up?
The attacker swapped USDC and USDT into Ether, moved it through instant-swap services Kyrrex and WellWallet, converted it into Monero via a venue identified as Wagyu, and then used cross-chain bridges, ZachXBT's tracing shows.
Why is this theft harder to recover from than the Binance or Bitget hacks?
In the Binance and Bitget cases, Circle and Tether froze some stablecoins and the escaped funds at least remained visible on public chains as Ether. Here the money was converted into Monero, a privacy coin that hides transaction details, making the trail far harder to follow.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Hannah Collymore
Hannah is a writer and editor with nearly a decade of blog writing and event reporting experience in the crypto space. At Cryptopolitan, Hannah contributes to the news page, reporting and analyzing the latest developments in DeFi, RWA, crypto regulation, AI and frontier tech industries. She graduated from Arcadia university with a degree in Business Administration.
