blockintAI · Research blog

ZachXBT Says an EU Entity Lost $133M+: 108.6M USDC Reached His 15 Theft Wallets, 17.2M of It After His First Alert

BlockintAI · 2026-11-03T22:16:47.521Z

At 6:28 AM CT on Monday, November 2, 2026, investigator ZachXBT posted a community alert. ZachXBT says: "An EU entity is suspected of losing $106M+ from multiple centralized exchange accounts yesterday (Nov 1). The suspected stolen funds were withdrawn as USDC & USDT by an illicit actor." He listed 11 Ethereum theft addresses.

At 1:31 AM CT on Tuesday, November 3, he raised the total. ZachXBT says: "I’ve identified an additional $27M+ of CEX withdrawals by the illicit actor bringing the total to $133M+ for the incident. A portion of the CEX withdrawals occurred after my initial disclosure." He added four more addresses.

The victim hasn't been publicly named. This post reads what the 15 published addresses did on Ethereum: where the USDC came from, when it arrived, how it turned into ETH, and what has moved since Monday.

Times are US Central Time (CT). Before 2 AM on November 1 that means CDT (UTC-5); after it, CST (UTC-6).

Key facts
Reported loss ZachXBT says $106M+ (Nov 2), raised to $133M+ (Nov 3)
Victim Not named. ZachXBT says his "working theory is a large financial institution in Western Europe was exploited and it's currently being covered up"
Actor ZachXBT says the actor is "not Lazarus Group but French-speaking and has a bit of onchain overlap with cybercrime forum users"
USDC into the 15 addresses 108,633,306.84 USDC on Nov 1 and 2, BlockintAI's on-chain sum of real USDC transfers: 80,794,947.36 into the first 11 and 27,838,359.48 into the four added on Nov 3. No USDT. This sum is separate from ZachXBT's figures
Sent from Transactions sent by wallets Etherscan labels Kraken: Hot Wallet 4, Crypto[.]com 12 and OKX 217
After the first alert 17,245,989.48 USDC reached two of the new addresses between 9:46 and 10:30 AM CT on Nov 2, more than three hours after ZachXBT's 6:28 AM CT post
Laundering USDC swapped to ETH through UniswapX; funds also moved through Multiswap, FixedFloat, NEAR Intents, Rango, Relay and a contract Blockscout shows as SwftSwap
Last 24 hours The four largest ETH-holding wallets went from 17,417.52 ETH to 6,506.26 ETH between 10:34 AM CT Nov 2 and 7:31 AM CT Nov 3
BlockintAI reports First report and Nov 3 update

On-chain figures come from Etherscan, eth.blockscout.com and public Ethereum RPC reads. Balances were last read at 7:31 AM CT (block 26,334,588) on November 3. Funds are still moving.

What the exchanges have said

Cointelegraph reports that Kraken said: "This incident did not originate on the Kraken platform, and we're actively investigating reports that some of the assets were subsequently moved through accounts on our platform. We've restricted the accounts in question and are working with law enforcement to support recovery efforts." Cointelegraph also reports that Kraken said its security systems had not been compromised and no customer accounts had been taken over.

Crypto[.]com told Cointelegraph it had "taken appropriate action to block any funds associated with this third-party incident from moving through Crypto[.]com." OKX said it was looking into the matter.

Where the USDC came from

From November 1 to November 3, the 15 addresses received only USDC from these senders, and no USDT.

  • Kraken-labeled sender. Most of the USDC came out of 0x2744dfd9…a22b, an unlabeled smart-contract wallet. Every transfer from it to a theft address was in a transaction sent by the address Etherscan labels Kraken: Hot Wallet 4 (0x05ff6964…f381). In the first 11 addresses that was 74,816,534.46 USDC in 68 transfers. All the USDC in the four new addresses came the same way, in 24 more transfers.
  • Crypto[.]com-labeled sender. 5,373,809.18 USDC came directly from the address Etherscan labels Crypto[.]com 12 (0x46340b20…9758), in three transfers to 0x8A97…C6B0 between 4:44 and 4:54 PM CT on November 1.
  • OKX-labeled sender. 604,603.73 USDC came out of another unlabeled smart-contract wallet, 0x1dfc6bec…e1d4, in six transactions sent by the address Etherscan labels OKX 217 (0x3b98b9e9…5e4f), all to 0xd010…a16a.

ZachXBT says the funds were withdrawn from "multiple centralized exchange accounts."

The first theft USDC arrived at 6:25 AM CT on November 1 and the last into the original 11 at 8:09 PM CT that night. Several addresses took a small test transfer first: 0xADd9…Dd58 got 1,000 USDC at 2:06:59 PM CT and 9,806,638.62 USDC 72 seconds later. 0xA109…7224 received 1,989,975 USDC in 43 transfers of 11,125 to 49,997 USDC over 91 minutes.

17.2M USDC after the alert

ZachXBT says "a portion of the CEX withdrawals occurred after my initial disclosure." On-chain, two of the four new addresses received their USDC after his first post.

New address USDC received When (CT)
0x3e6c3d135ca8f8be793e5fe1715ce6c057d140f2 5,343,190.00 Nov 1, 12:07 to 12:09 PM
0x99d314e6970b8d3db0dbe6f6e041cc904143400f 5,249,180.00 Nov 1, 4:18 to 5:09 PM
0x5cf70edce65847ef989933c3072fb0e7f335abc1 8,515,976.44 Nov 2, 9:46 to 9:50 AM
0xe378cdccb369a64a0190577787ef61ca2eefa6b2 8,730,013.03 Nov 2, 10:28 to 10:30 AM

The last two arrived three to four hours after ZachXBT's 6:28 AM CT alert, 17,245,989.48 USDC in all. Neither held it long. 0xe378 sent 5,320,950 and 3,409,000 USDC onward at 10:35 and 10:36 AM CT. Both new addresses paid the same wallet, 0xc5b2a8ba…aadd, which pushed 6,803,600 USDC into the contract Etherscan labels Rango V2: Rango Diamond in 43 lots between 11:20 AM CT November 2 and 3:37 AM CT November 3.

How the USDC became ETH

From the theft addresses, the USDC fanned out through a layer of fresh wallets created that day. Most of it ended up at one hub, 0x9eca05d78f6751c91ab048858b7d21a67c015547, which received about 60.7M USDC.

The hub swapped through UniswapX orders: it offered USDC, and third-party fillers delivered ETH in return. Two examples:

Both fills emit events from the contract Etherscan labels UniswapX: Dutch Order Reactor V2. In total the hub received about 27,699 ETH. ETH can't be frozen by an issuer, which USDC can.

The hub's first ETH, 0.1253 ETH for gas at 5:40:59 PM CT on November 1, came from the address Etherscan labels Well Wallet: Hot 1. ZachXBT says the actor transferred funds to instant exchanges including WellWallet and Kyrrex and converted to Monero through Wagyu. Other routes visible on-chain:

  • Multiswap[.]fi (Etherscan label): 2,001,000 USDC on November 1 and 1,463,500 USDC from the 0x99d3 branch, each forwarded through one intermediate wallet
  • FixedFloat: Hot Wallet 2 (Etherscan label): about 1.2M USDC through 13 one-time addresses of 90,000 to 100,000 USDC each
  • NEAR Intents, Rango Diamond and Relay's router contract: bridge and swap deposits
  • A verified contract that Blockscout shows with the contract name SwftSwap (Etherscan shows no label for it): swap deposits
  • An address Etherscan labels KuCoin Deposit: about 4.66M USDC from four wallets in the laundering layer

What moved in the last 24 hours

On Monday at 10:34 AM CT, the first BlockintAI report listed five wallets holding the ETH: 7,343.93, 3,941.09, 3,713.58, 2,418.92 and 310.15 ETH. Here's the same read at 7:31 AM CT Tuesday.

Wallet ETH, 10:34 AM CT Nov 2 ETH, 7:31 AM CT Nov 3
0x65c33571ca72885637076b84db517809c16eb841 7,343.93 0
0x18ec8239cbd3062289e4bd514250d14bdd426413 3,941.09 2,287.08
0x448cdc9b813d3bdeabcc07a922ac4e06aaa97337 3,713.58 1,960.26
0x05184a1b5c68b5b7ef826023a4e1d7cc67d1b01e 2,418.92 2,258.92
0x9eca05d78f6751c91ab048858b7d21a67c015547 (hub) 310.15 310.15
  • 0x65c3 emptied into a new wallet. Between 12:16 and 12:18 PM CT on November 2, it sent 7,115 ETH in three transfers to a fresh address, 0xc3ddc1a5…5d07, and 228.93 ETH to 0xa07d002e…240a, a wallet already in the laundering layer. At 5:06 PM CT 0xc3dd passed 4,450 ETH to 0xa3a98584…ae0d, an address first used about two and a half hours earlier, which sent 395 ETH on at 3:26 AM CT on November 3. At 6:20 AM CT 0xc3dd sent another 441 ETH to an older wallet. At 7:31 AM CT the two new wallets held 2,221.99 ETH and 4,055.00 ETH, 6,276.99 ETH in all, in two wallets first used on Monday.
  • 0x18ec and 0x448c paid out in lots of about 44 to 500 ETH overnight. One recipient, 0x5890d7ba…b3e4, received 487.15 ETH from both wallets between 2:14 and 5:45 AM CT and sent 486.23 ETH into the contract Blockscout shows as SwftSwap, each time within 13 minutes of the deposit. Another, 0x92dc1d84…b62f, received 221.93 ETH at 2:27:23 AM CT and forwarded all of it to the address Etherscan labels Multiswap[.]fi 12 seconds later.
  • Three 500 ETH transfers on Tuesday morning. At 6:59 AM CT 0x18ec sent 500 ETH, and at 7:12 AM CT 0x448c sent 500 ETH, each to a newly created contract that passed it on within seconds to the same verified contract, which Blockscout shows with the contract name Sweeper. At 7:24 AM CT 0x448c sent another 500 ETH to the contract Etherscan labels LI[.]FI: LiFi Diamond.
  • 0x0518 sent 160 ETH to a fresh address at 5:48 AM CT.

What this shows

  • Freezable money turned unfreezable fast. The stolen funds left the exchanges as USDC, which Circle can freeze. Within hours most of it was ETH.
  • The alert didn't stop withdrawals. 17.2M USDC left exchange accounts after ZachXBT named the first addresses.
  • The ETH is still on Ethereum and still traceable. At 7:31 AM CT, about 6,816 ETH sat in the five wallets above and 6,277 ETH more in the two new wallets. Exchanges and swap services can screen deposits against these addresses.

If you run compliance at an exchange or swap service, screen deposits against the addresses below and the full lists in the two BlockintAI reports. Watch for lookalike addresses too: address-poisoning spam has hit nearly every wallet in this trail.

Addresses in this post

Theft addresses ZachXBT published on November 2:

Theft addresses ZachXBT added on November 3:

  • 0x5cf70edce65847ef989933c3072fb0e7f335abc1
  • 0xe378cdccb369a64a0190577787ef61ca2eefa6b2
  • 0x3e6c3d135ca8f8be793e5fe1715ce6c057d140f2
  • 0x99d314e6970b8d3db0dbe6f6e041cc904143400f

Swap hub and ETH-holding wallets (paid from the theft flow):

  • 0x9eca05d78f6751c91ab048858b7d21a67c015547
  • 0x65c33571ca72885637076b84db517809c16eb841
  • 0x18ec8239cbd3062289e4bd514250d14bdd426413
  • 0x448cdc9b813d3bdeabcc07a922ac4e06aaa97337
  • 0x05184a1b5c68b5b7ef826023a4e1d7cc67d1b01e

Sources

Lost money? Report it to IC3 (FBI) at ic3.gov and the FTC at reportfraud.ftc.gov, and file at https://blockint.ai/c3?mode=file