Major cryptocurrency exchanges, including Kraken, Crypto.com, and OKX, have taken decisive defensive actions following reports of a massive, suspected cryptocurrency theft totaling more than $133 million from an unidentified European Union entity. The unfolding digital asset security incident has drawn intense scrutiny from blockchain forensics experts and international law enforcement agencies as investigators race to trace, freeze, and recover the stolen funds amidst complex cross-chain laundering patterns.
Cryptocurrency exchange Kraken confirmed that it has restricted accounts linked to the suspected theft and is actively cooperating with law enforcement to support recovery efforts. The platform emphasized that the security breach did not originate within its internal infrastructure, maintaining that its proprietary security systems remain entirely uncompromised.
"This incident did not originate on the Kraken platform, and we’re actively investigating reports that some of the assets were subsequently moved through accounts on our platform," a Kraken spokesperson told Cointelegraph. "We’ve restricted the accounts in question and are working with law enforcement to support recovery efforts." Furthermore, Kraken assured the public that no customer accounts were taken over during the ordeal and that there is no ongoing risk to regular platform users.
Kraken’s public acknowledgment followed crucial disclosures made by prominent on-chain blockchain investigator ZachXBT. On Tuesday, ZachXBT revealed that he had identified an additional $27 million in suspicious withdrawals routed through various centralized exchanges. This new finding drove the total estimated losses up significantly from the initial $106 million figure he had reported just a day prior on Monday. According to the investigator’s findings, a significant portion of these withdrawals occurred immediately after his initial public disclosure alerted the broader market to the ongoing exploit.
Comprehensive forensic analysis provided by blockchain analytics firm Bitquery confirmed that the suspected stolen funds were funneled out of accounts established at Kraken, Crypto.com, and OKX. Bitquery’s detailed investigation revealed a rapid and aggressive liquidation pattern: roughly $62.98 million worth of various stablecoins was systematically converted into 27,553 Ether in the span of just four hours.
As the situation escalated, other major trading platforms moved quickly to insulate their systems. Crypto.com announced that it had implemented strict preventive measures to block any financial transactions or asset movements associated with the third-party security incident from traversing its network.
"We are aware of this report and have taken appropriate action to block any funds associated with this third-party incident from moving through Crypto.com," a company representative stated. The platform reassured users that its operations remain completely uninterrupted and that all customer funds are fully secure and accessible. Meanwhile, OKX acknowledged inquiries from the media, confirming that its internal security and compliance teams were actively looking into the matter.
Detailed tracking data from Bitquery illustrates the sheer speed and scale at which the suspected attacker moved to disperse the capital. As of 13:47 UTC on Monday, approximately $78.3 million remained sitting inside wallets directly linked to the perpetrator, while an estimated $30.5 million had already been successfully moved out of the initially tracked blockchain addresses.
The battle to freeze the funds has proven challenging due to the asset composition and the speed of conversions. At the time of the tracking update, only $3.74 million remained in USD Coin, leaving a narrow window for stablecoin issuer Circle to potentially execute a freeze. Meanwhile, stablecoin issuer Tether had already taken proactive steps to freeze $1.1 million worth of USDT tied to the illicit addresses.
Victim’s Identity Remains Unverified
The exact identity of the victimized entity has not yet been officially confirmed, fueling widespread speculation and debate within the global cryptocurrency community. Sharing his insights on his official Telegram channel, ZachXBT outlined his primary hypothesis regarding the origin of the massive security breach.
"My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up," ZachXBT stated.
The investigator sharply criticized the lack of transparent, immediate incident disclosure from the affected party, arguing that the silence directly enabled the launderers to successfully move and obscure more than $30 million. He claimed that if a prompt public notice or report had been filed, European Union law enforcement agencies might have acted swiftly enough to freeze the assets before they could be broken down and transferred across bridges. At present, however, the victim’s identity and the allegations surrounding a potential institutional cover-up remain unverified.
Delving deeper into the mechanics of the heist, ZachXBT noted that the attacker has been actively swapping the stolen capital into Ether and privacy-focused cryptocurrency Monero. These conversions are reportedly being executed through a combination of instant exchanges and complex cross-chain bridges designed to obfuscate transaction histories. Interestingly, the investigator pointed out that the specific laundering techniques and tactical patterns observed in this case do not align with the standard operational signatures typically deployed by North Korea’s notorious Lazarus Group, suggesting a different actor behind the multi-million dollar theft.
Comments (0)