How much of the $133 million can be independently traced?
Separate blockchain analysis by Bitquery traced $108.8 million in USDC leaving accounts at Kraken, Crypto.com and OKX over approximately 21 hours on November 1 and 2. Its analysis covered Ethereum activity and therefore does not account for every transaction included in ZachXBT’s broader $133 million estimate.Bitquery found that $62.98 million in stablecoins was converted into 27,553 ETH through UniswapX within roughly four hours. At its November 2 snapshot, approximately $78.3 million remained in Ethereum addresses linked to the suspected attacker, while about $30.5 million had already exited the tracked wallets through exchanges, bridges and other services.Only around $3.74 million remained in USDC at that point, leaving a relatively small portion that Circle could directly immobilize through its blacklist function.The distinction matters because ZachXBT’s latest figure remains an investigator-attributed estimate rather than a loss total confirmed by the victim, the exchanges or law enforcement.
Investor Takeaway
Why did the window for freezing funds close so quickly?
ZachXBT argues that more than $30 million could have been stopped if the incident had been disclosed and escalated earlier to exchanges and European law enforcement. That conclusion has not been independently established, but the transaction sequence shows that substantial amounts moved away from immediately freezeable assets within hours.Bitquery found that several withdrawals were forwarded to new addresses within minutes. The funds were then divided between ETH purchases, DAI, cross-chain routes, exchange deposits and services associated with conversions into Monero.The pattern resembles a recurring challenge in major crypto thefts: investigators and issuers have a limited period to intervene before stablecoins are converted into assets without centralized freeze controls. FinanceFeeds recently examined the same dynamic after Tether and Circle froze billions of dollars linked to the Binance breach, while other assets had already moved beyond those controls.ZachXBT previously criticized Circle over what he described as delayed or absent freezes across multiple illicit-fund cases. Those allegations illustrate the tension between rapid intervention and the legal and evidentiary requirements imposed on centralized issuers.
Investor Takeaway
What have the exchanges said about the incident?
Crypto.com said it was aware of the report and had taken action to prevent funds associated with the third-party incident from moving through its platform. The company said its own systems remained operational and customer funds were secure.There is currently no evidence that Kraken, Crypto.com or OKX themselves were hacked. Bitquery’s analysis instead suggests that the attacker accessed accounts belonging to a customer and may also have obtained control over wallets previously used by that customer.Eleven of the 15 Ethereum addresses identified by Bitquery had previously received funds from the same exchanges, suggesting that many were established withdrawal destinations rather than newly created attacker wallets. That could indicate compromise extending beyond exchange credentials to the victim’s own wallet environment, although the blockchain data cannot determine how access was obtained.The situation differs from incidents where exchange infrastructure itself is breached. FinanceFeeds recently reported how investigators traced $93 million linked to thefts affecting Ledger users, another case in which rapid movement across stablecoins, exchanges and other networks complicated recovery.
What remains unknown?
The victim has not identified itself, no law-enforcement agency has publicly confirmed ZachXBT’s description of a Western European financial institution, and the method of compromise remains unclear.ZachXBT also said the laundering behavior does not resemble patterns typically associated with North Korea’s Lazarus Group. That assessment narrows one possibility but does not identify the attacker.The next important developments will be confirmation of the victim, updated tracing of the additional $27 million, disclosure of any frozen or recovered assets and evidence explaining how multiple exchange accounts and associated wallets were accessed.