ZachXBT Flags Possible Cover-Up as Crypto Theft Estimates Cross $133 Million

Blockchain researcher ZachXBT has raised the estimated worth of what appears to be a suspected theft involving an unnamed European firm to over $133 million (roughly Rs. 1,260 crore), after tracking an additional $27 million (roughly Rs. 255.8 crore) worth of withdrawals made from centralised exchanges. As per a statement released by ZachXBT in a November 3 update, this transaction is linked to the same culprit mentioned in his previous research. Some of these withdrawals happened after the theft was revealed by the researcher.

ZachXBT Identifies Additional Wallets and Traces Suspected Laundering Activity

ZachXBT now believes that a big financial institution in Western Europe might have been breached by the criminals and is hiding the breach. The research started with a community alert made on November 2 by ZachXBT, who reported that a European entity was under suspicion for having lost more than $106 million (roughly Rs. 1,004 crore) from some centralised exchange accounts on November 1. At the moment, he pointed out several wallet addresses involved in the withdrawal and produced a map of transactions describing how the suspected stolen money had been transferred.

In the latest update, another four addresses were included in the investigation, increasing the total number of theft addresses to 15. The investigator is especially harsh about the lack of any incident disclosure, saying that at least $30 million (roughly Rs. 284.2 crore) worth of funds had already been laundered and could have been seized under EU law enforcement regulations.

According to the findings of ZachXBT, the attacker had first withdrawn the assets believed to be stolen in two dollar-pegged stablecoins, which were USD Coin (USDC) and Tether (USDT), prior to carrying out the transactions. Within the next 24 hours, the wallets were used to exchange USDC for Ethereum (ETH), and part of the assets was moved to instant crypto exchanges, such as WellWallet and Kyrrex. The investigator found another way, through Wagyu, where the funds were exchanged for the privacy-focused cryptocurrency Monero (XMR).

Additional transactions were made to connect assets across multiple blockchain networks, allowing the suspected hacker to transfer funds through various chains rather than keep them within one chain. ZachXBT stated that he is very sure that the hacker is not the North Korean Lazarus Group, noting a number of aspects from the laundering transactions that do not fit into the pattern of the hacking group. In another post on X, ZachXBT mentioned that the suspected hacker is French-speaking and has some on-chain links to cybercrime forum users.