$133M Crypto Theft May Have Hit a European Bank

• ZachXBT has raised his estimate of a suspected crypto theft tied to an unnamed European victim.
• He suspects a large Western European financial institution is keeping the breach quiet.
• The attacker sent funds to wallets the victim had used before, pointing to stolen keys.
• The case follows the Binance theft, the largest in crypto history by dollar value.

Blockchain investigator ZachXBT has raised his estimate of suspicious crypto withdrawals linked to an unidentified European organization to more than $133 million, up from $106 million less than two days earlier, and he now argues that the victim may be a large Western European financial institution keeping the incident quiet. No company has been named in his Telegram post and no loss has been confirmed, but the case comes just days after Binance lost about $6.36 billion, and early evidence in both points to attackers who gained access to accounts and keys instead of exploiting flawed code.

The Thief Already Had the Victim’s Wallets

Bitquery, a blockchain analytics firm, traced $108.8 million in USDC withdrawals that began at 12:25 UTC on November 1 from accounts at OKX, Kraken and Crypto.com, with Kraken accounts supplying about 95% of the total. Of the 15 wallets that first received the money, 11 had taken payments from the same exchange accounts before, and those wallets absorbed around 84% of the funds. Exchanges usually add checks to withdrawals heading to a new address, so payouts to destinations the victim had used for months would have looked like routine treasury activity and passed without friction.

Using those wallets required both the exchange logins and the private keys, so Bitquery names compromised devices, stolen credentials or an insider as possible routes. Nothing shows that the exchanges’ own systems were breached. Crypto.com has reportedly said it blocked related funds, OKX is investigating and Kraken has not given a detailed response.

$63M Became ETH Before Anyone Froze It

Within about four hours, roughly $62.98 million in stablecoins became 27,553 ETH through UniswapX, a swap system on Ethereum. The timing mattered because Circle and Tether can blacklist their tokens at a given address, while no company can freeze native ETH. Smaller sums went to a KuCoin deposit address possibly linked to Kyrrex, the LI.FI bridge and the instant exchange FixedFloat, and part passed through Monero, a privacy coin that hides sender, receiver and amount.

Figures come from different datasets and should not be added together.

ZachXBT Sees a Bank, Bitquery Sees a Trading Desk

On November 3 ZachXBT set out a “working theory” that a large Western European financial institution “was exploited and it’s currently being covered up,” and he claimed that more than $30 million could have been frozen with prompt disclosure. He has named no institution and offered no proof of concealment. Bitquery reads the wallets more cautiously, as the setup of a trading or payments business using ordinary crypto wallets, without the custody arrangements a traditional bank would normally run. ZachXBT has also said he is highly confident that North Korea’s Lazarus Group is not involved.

DORA’s Four-Hour Clock

If the victim is a bank, a payment institution or a crypto firm licensed under MiCA, the EU’s crypto rulebook, the Digital Operational Resilience Act (DORA) applies. Since January 17, 2025, it has required such firms to report major ICT incidents, meaning serious attacks on or failures of their technology systems, to their supervisor, with an initial notice due within four hours of classifying an incident as major and no later than 24 hours after detecting it. Those reports stay confidential, so public silence does not prove the victim failed to file.

Three Days After Binance Lost $6.36B

The European withdrawals started three days after the largest theft in crypto history. On October 29 an attacker moved about $6.36 billion out of Binance wallets across ten blockchains, most of it in roughly 20 minutes, according to TRM Labs, which attributed the attack to North Korean hackers. Binance traced the entry point to a DevOps engineer’s compromised laptop, later found further points of breach, and said about $3 billion had been frozen with partners. It has since restored backing for 90% of the stolen assets from its own reserves, while nobody has said who, if anyone, will cover the European losses.

Why Audits Miss 2026’s Biggest Losses

TRM Labs counted 207 hacks in the first half of 2026, a record for any half-year, even though losses in that period fell to $972 million, and the months since have made the picture worse. CertiK put losses through September at $2.68 billion, and Binance alone then added more than twice that in one night, pushing 2026 far past the $2.87 billion TRM recorded for all of 2025. CertiK has said the largest breaches this year came from compromised credentials and devices, a pattern the European case appears to match. Smart-contract audits, the industry’s main security check, do not catch a stolen laptop or a leaked private key, which shifts the risk to how exchanges and their corporate clients protect logins, keys and the people who hold them.

For the European case, recovery now depends on the $3.74 million in USDC and on deposit platforms that receive ETH from the 15 addresses ZachXBT has published, since a centralized service can hold flagged deposits once alerted. ZachXBT has also reportedly described the suspect as French-speaking with on-chain ties to cybercrime forum users, the first identifying lead, although no nationality or identity has been confirmed.