Suspected $106M Crypto Theft Ran Through Familiar Wallets

Key Takeaways

• $108.8M in USDC left three exchange accounts.
• 11 of 15 receiving wallets had prior payouts.
• $62.98M in stablecoins became 27,553 ETH.
• Only $3.7M remained in freezable USDC.

The figures come from Bitquery’s November 2 investigation, which followed the money after on-chain investigator ZachXBT flagged the suspected theft from an EU entity, as relayed in a post by the X account Officer’s Notes.

Twenty-One Hours Across Three Exchanges

The first withdrawal left OKX at 12:25 UTC on November 1. Kraken followed 44 minutes later and ended up paying 95% of the total, with Crypto.com supplying the rest alongside OKX. About two-thirds of the money, $73.2 million, went out in the three hours to 23:00 UTC. The final payment landed at 09:09 UTC the next morning.

One wallet received 43 Kraken withdrawals in 91 minutes, each below $50,000. Bitquery reads that as the thief working around a limit on individual withdrawals. If so, the cap changed the shape of the outflow, not its size.

$106M+ The first public estimate, attributed to ZachXBT $108.8M USDC Bitquery counted from the exchanges’ main wallets to 15 addresses $95.7M The count without two wallets linked to the thief only through intermediaries

None of those is a loss the victim has confirmed. Bitquery read Ethereum only and checked the three exchanges’ main wallets, so other chains and other wallets at the same exchanges could add to the count. The victim is unnamed. The wallets’ history points to a trading or payments business that has used Kraken since May, a view Bitquery says it holds loosely.

Why the Old Wallets Point Past the Exchange Login

Eleven of the 15 receiving wallets had taken payouts from the same exchanges before November 1, and together they received 84% of the money. The oldest took its first Kraken withdrawal on May 4 and 48 more before the theft. Several of the wallets paid one another over the summer. Eight of the 15 are Trust Wallet smart accounts set up to pay network fees in USDC, though Bitquery found nothing pointing to a flaw in the app itself.

That history is why Bitquery treats the wallets as the victim’s own, and it explains why the exchange login alone does not account for what happened next. The USDC typically moved on to a fresh wallet within three minutes, and sending it onward required the keys to the receiving wallet. Bitquery concludes the thief most likely held both the logins and those keys. In its reading, that points to a break-in on the owner’s devices or wallet setup, or to someone inside the victim’s own team. The chain cannot tell those apart.

The ownership call is still an inference from wallet behaviour, and neither the victim nor the exchanges have confirmed it. If some of those addresses belonged to an employee, contractor or counterparty, earlier payouts would show that the entity trusted a person, not that its own keys leaked. Either way, nothing in the trace shows a breach of Kraken, Crypto.com or OKX. The withdrawals came from one customer’s accounts.

Where an Allowlist Holds and Where It Gives Way

An allowlist lets an account withdraw only to addresses approved in advance. The trace splits this theft into two cases, and they test that setting differently.

The 11 familiar wallets are the case an allowlist cannot address. If they were already approved, transfers to them would pass the check, because the setting restricts the address and says nothing about who holds its keys today.

The four new wallets, which took $17.27 million, are the opposite case. The first payments from both OKX and Kraken went to addresses with no prior history. As Bitquery puts it, if the accounts used an allowlist, the thief was able to add to it, and if they had none, the money could go anywhere. Whether any of these accounts had one switched on is not public.

That second route is what the exchanges’ additional controls are built for:

OKX

Alongside the allowlist, a separate new-address lock blocks withdrawals to a newly added recipient for 24 hours.

Crypto.com Exchange

A 24-hour hold applies to newly whitelisted addresses, and switching the feature off takes another 24 hours to take effect.

Kraken

The Global Settings Lock blocks new withdrawal addresses and changes to protected settings. Lifting it means waiting out a delay the user chose, unless they set up a Master Key beforehand, a separate credential that can override the wait.

None of these touches a wallet that is already on the list. A lock that slows new addresses still lets anyone with the right keys use an old one.

Swapped Out of Freezable USDC Within Hours

The withdrawals left as USDC, which its issuer, Circle, can freeze at any address. ETH has no issuer, and DAI has no freeze function, so converting was the thief’s first job.

Shortly before midnight UTC on November 1, a fresh wallet began selling stablecoins through UniswapX, an auction in which trading firms compete to fill orders. In about four hours it sold $62.98 million in USDC and USDT for 27,553 ETH, roughly $2,286 per coin. Another branch of the funds went into DAI. Bitquery saw no Circle freeze during the sale or at its check on Monday, and says it does not know whether anyone asked Circle to act.

At 13:47 UTC on November 2, $78.27 million still sat on Ethereum in addresses Bitquery ties to the thief, most of it beyond any issuer’s reach:

What the remaining funds were held in

ETH · $68.9MNo issuer to freeze it DAI · $5.6MNo freeze function USDC · $3.7MCircle can freeze it

About $30.5 million had already left. The largest exit, $8.12 million, went to a KuCoin deposit address that Bitquery believes is the pooled account of Kyrrex, a European exchange. LI.FI, a bridge and swap router, took $4.34 million, part of it through one-time order wallets that analytics firm TRM tags as Wagyu, a service that swaps into Monero. FixedFloat, an instant exchange that requires no account, took $1.32 million.

Seeing the ETH on Ethereum gives the victim no way to move it back. What can still be reached depends on parties with power over their slice: Circle over the remaining USDC, KuCoin and Kyrrex over whose account the deposit credited, and the instant exchanges over who placed the orders.

What Would Settle the Access Question

Kraken, which paid 178 of the withdrawals, can confirm who owns the account and what happened inside it. Three records would test Bitquery’s theory: when the four new addresses were added and whether a lock or delay applied at the time; whether the withdrawals came through a logged-in session or through API keys with withdrawal rights; and whether any security setting changed in the hours before 12:25 UTC on November 1.

If those logs show the new addresses went through because a waiting period was switched off, the lesson moves toward account settings. If the settings were intact and the money still moved through old wallets, the wallet-key reading gets stronger. The nearest public signal is narrower: whether Circle freezes the 3.74 million USDC still held, nearly all of it in five wallets, before the thief moves it.

How a 10 ETH Refund Bug Froze THORChain Trading on 10 Chains

Check Who Can Spend From Every Saved Address

For anyone holding large exchange balances, the trace argues for auditing a withdrawal list by keyholder rather than by address. For each saved destination, the question is which phone, laptop, browser extension or service can sign for it today, and whether that same device also holds the exchange login. Bitquery’s point is that one break-in on such a device opens both.

The defences it suggests follow from that: a hardware key for logging in and for the wallets on the allowlist, the new-address waiting period switched on, and the same watch on allowlisted wallets as on the account itself. A payment landing in a wallet you stopped using is a warning sign. Coindoo found a similar gap when old wallets were drained after traders stopped using a bot: an address you no longer think about can still have someone able to spend from it.