ZachXBT Finds $27M in Extra Withdrawals, Raising Suspected EU Theft Above $133M

TL;DR

• ZachXBT identified more than $27 million in exchange withdrawals, raising his estimate of a suspected theft involving an unidentified EU entity above $133 million.
• The actor moved USDC and USDT into ETH, instant exchanges, bridges and Monero, while ZachXBT added four Ethereum addresses to the original set.
• ZachXBT suspects a large Western European financial institution was exploited and withheld disclosure, but the victim’s identity, loss and alleged cover-up remain unverified.

Blockchain investigator ZachXBT has raised the estimated size of a suspected theft involving an unidentified EU entity to more than $133 million, after tracing over $27 million in additional withdrawals from centralized exchanges. In his latest investigation update, he said some of those withdrawals occurred after his initial public disclosure. The case centers on stablecoin transfers from multiple exchange accounts, but no institution has publicly confirmed being the victim.

Additional Exchange Withdrawals Expand Suspected Theft as Funds Move Across Chains

The original alert identified more than $106 million in suspected stolen USDC and USDT withdrawn on November 1. The newly identified transactions lift ZachXBT’s working estimate above $133 million rather than establishing a confirmed institutional loss. He added four Ethereum addresses to the 11 addresses disclosed initially and said the laundering indicators did not resemble Lazarus Group operations. The suspected victim remains unidentified, and no institution or authority has publicly verified the incident.

ZachXBT said the actor aggressively converted USDC into ETH, routed funds through instant exchanges, converted part of the proceeds into Monero and bridged assets across multiple chains. He specifically named WellWallet and Kyrrex among the instant exchanges and Wagyu as a route used to obtain XMR. The activity places the incident alongside broader Monero laundering investigations, while the onchain trail remains central to identifying where the stolen value moved.

The investigator also alleged the lack of a proper incident disclosure allowed more than $30 million to be laundered beyond potential freezing points, arguing European law enforcement could otherwise have frozen those funds. That remains ZachXBT’s assessment, not a confirmed finding from authorities. The episode highlights the time-sensitive nature of intervention when centralized stablecoins are involved, an issue also examined in earlier USDC freeze disputes, without proving that all funds were recoverable.

ZachXBT’s working theory is that a large financial institution in Western Europe may have been exploited and may be withholding disclosure, but he has not named the institution or established a cover-up publicly. The allegation therefore remains unverified. The case nevertheless shows how independent onchain analysis can surface suspected losses before formal confirmation, echoing previous ZachXBT investigations into stolen-asset clusters. Further confirmation now depends on an affected institution, exchange or authority publicly identifying the incident. Until then, the $133 million figure should be treated as ZachXBT’s blockchain-analysis estimate rather than a confirmed loss or official incident total.