Mystery $106 Million Crypto Theft Hits EU Entity Days After Binance Hack

What it is

Decrypt reports that pseudonymous onchain investigator ZachXBT said on Monday, 2 November 2026, that an unnamed EU entity lost more than $106 million from several centralized exchange accounts on Sunday, 1 November. The post was on ZachXBT's Telegram channel. The victim is not named, the culprit is unidentified, and ZachXBT says with "a high degree of confidence" it is not Lazarus Group, citing multiple laundering indicators.

Why freezing matters here

The thief withdrew USDC and USDT, which Tether and Circle can freeze. The page says the attacker then swapped out of them, which is why the order of events matters. In the Binance hack, which the FBI attributed to TraderTraitor (a North Korean group), Tether froze stolen USDT on Ethereum in 37 minutes. Circle froze all $823 million of stolen USDC. Elliptic says this helped lock up about 44% of that $6.4 billion haul. The page says it is unclear whether any funds in the EU case have been frozen.

Other incidents the page lists the same week

• Mercado Bitcoin, a Brazilian exchange, halted withdrawals after a $40 million hack.
• BTCPay Server told merchants to switch off their servers amid reports of hot wallet attacks.
• After the Binance theft, North Korean launderers spread the remaining funds across about 12,000 wallets.

What to do

The page gives no remediation steps. Its one concrete artifact is the list of 11 Ethereum addresses ZachXBT published for the EU theft, which teams can use for address screening and monitoring. The addresses are not reproduced in the Decrypt text, so they must be taken from ZachXBT's post. Anyone running BTCPay Server should check its official channels for the merchant notice, since the page gives no details of the reported attacks.

Caveats

The loss figure and the attribution rest on one investigator's statement. The page does not say how the accounts were compromised.