Over $106M Stolen From EU Entity as Crypto Security Incidents Surge
Blockchain investigator ZachXBT tracks complex laundering patterns following a massive $106 million crypto theft.
1Large Scale EU Theft
On November 1, an unnamed European Union entity suffered a significant crypto theft exceeding $106 million. Blockchain investigator ZachXBT identified the breach, noting that the stolen assets were primarily held in USDC and USDT. The attacker quickly initiated aggressive swaps, moving funds through various centralized exchange accounts to obscure the original source of capital.
2Complex Laundering Mechanisms
The perpetrator utilized instant exchanges like WellWallet and Kyrrex to facilitate rapid asset movement without standard account requirements. Furthermore, the attacker converted funds into XMR using the non-custodial platform Wagyu to enhance privacy. These funds were bridged across multiple blockchain networks, creating a sophisticated trail designed to evade detection by standard financial monitoring tools.
3Lazarus Group Excluded
Despite the scale of the operation, ZachXBT expressed high confidence that the notorious North Korean threat actor Lazarus Group is not responsible for this specific incident. This conclusion is based on multiple distinct laundering indicators observed during the tracking process. The attacker's methodology suggests a different profile compared to previously documented state-sponsored cyber campaigns.
4Mercado Bitcoin Security Incident
Separately, the Brazilian exchange Mercado Bitcoin experienced suspicious outflows totaling over $40 million across 10 different networks. Security firm HypernativeLabs flagged the activity on platforms including Bitcoin, Ethereum, and Solana. The exchange confirmed the incident occurred but maintained that no customer data was breached and that the situation was swiftly contained by internal teams.
5Operational Response Measures
Following the detection of suspicious outflows, Mercado Bitcoin temporarily suspended all deposits and withdrawals to prevent further losses. The company is currently coordinating with competent authorities and mobilizing internal teams to track the stolen assets. This proactive measure aims to secure the platform while the investigation into the specific breach vector remains ongoing.
6BTCPay Server Vulnerabilities
BTCPay Server is investigating reports of unauthorized attackers sweeping hot wallets on older software instances. The vulnerability specifically affects versions 2.4.1 and older, where attackers reportedly gained administrative access. The platform clarified that there are no credible reports of wallet drains affecting users on the latest 2.4.7 release, urging immediate software updates.
7Broader Industry Context
These incidents occur against a backdrop of persistent security challenges within the digital asset ecosystem, including the massive $6.3 billion Binance hack. The frequency of these attacks highlights critical vulnerabilities in both centralized exchange infrastructure and self-hosted payment servers. Security professionals must prioritize rigorous patch management and cross-chain monitoring to mitigate these evolving risks.
8Implications for Asset Security
The recent wave of thefts underscores the necessity for enhanced security protocols across all crypto-related entities. As attackers refine their laundering techniques through privacy-focused bridges and instant exchanges, the industry faces increased pressure to implement robust defensive measures. Protecting user funds requires constant vigilance, rapid incident response, and transparent communication from all service providers.
Original article: CryptoPotato — Over $106M Stolen From EU Entity as Crypto Security Incidents Surge