Blockchain investigator ZachXBT says a suspected crypto theft tied to an unidentified entity in the European Union has grown significantly, with the working total now exceeding $133 million.
Blockchain investigator ZachXBT says a suspected crypto theft tied to an unidentified entity in the European Union has grown significantly, with the working total now exceeding $133 million. In a Tuesday update, he reported additional withdrawals from centralized exchanges after an initial disclosure the previous day.
The expanded figures matter because they suggest not only a larger immediate loss, but also that some of the outflows may have continued even while public investigations were beginning to circulate—potentially complicating later tracing and enforcement actions.
ZachXBT’s latest update comes after he said he identified another $27 million in withdrawals from centralized exchanges on Tuesday. That brings his suspected total to more than $133 million, up from the $106 million he initially flagged on Monday.
In his Telegram post, ZachXBT noted that some withdrawals occurred after his primary disclosure. The implication for market watchers is straightforward: once large-scale theft suspicions enter public view, investigators and compliance teams often move quickly. If the additional withdrawals still happened afterward, it suggests the attacker had sufficient operational runway to keep transferring assets.
Separate analysis from Bitquery provides a snapshot of how some funds may have been processed soon after the alleged theft. Bitquery reported that $62.98 million in stablecoins was converted into 27,553 Ether (ETH) within roughly four hours.
Bitquery also described the situation in terms of what remained in tracked wallets and what had already been moved. As of 13:47 UTC on Monday, Bitquery estimated that about $78.3 million remained in wallets linked to the suspected attacker, while $30.5 million had moved out of the tracked addresses.
Stablecoin exposure appeared limited by that moment as well. Bitquery said only $3.74 million remained in USDC that Circle could potentially freeze—an important operational detail because stablecoin issuers and exchanges may only be able to take immediate action on specific holdings, depending on custody and compliance pathways.
ZachXBT’s update was not limited to numbers. He offered a broader theory of intent, saying his “working theory” is that a large financial institution in Western Europe was exploited and that the incident is currently being covered up.
He further argued that the lack of a proper incident disclosure may have allowed more than $30 million to be laundered. According to ZachXBT, if authorities had received the right disclosure early enough, law enforcement could have frozen the funds. He added that the victim’s identity and the allegations of a cover-up are not verified.
For readers, the most consequential point here is the timing mechanism: in many theft cases, the gap between an incident and any formal disclosure or action can determine whether assets are still within reach. While the post asserts what could have happened under a disclosure scenario, it also highlights uncertainty around the underlying facts—what exactly was reported, when, and to whom.
ZachXBT previously said the attacker was swapping funds into Ether and Monero (XMR) using instant exchanges and cross-chain bridges. In his Tuesday update, he also claimed the laundering patterns did not match those typically used by North Korea’s Lazarus Group.
This distinction matters because Lazarus-related intrusions have, in past incidents, been associated with particular operational characteristics. However, ZachXBT’s assessment is still a directional comparison rather than a definitive attribution. The underlying event remains framed as “suspected,” and neither the entity alleged to be involved nor the alleged perpetrator has been identified in a way that would conclusively settle the attribution question.
Even so, Bitquery’s observation of fast stablecoin-to-ETH conversion suggests that whoever controlled the wallets prioritized liquidity and speed—two factors that can align with a range of threat actors, including both organized crime groups and state-linked operations.
Meanwhile, ZachXBT referenced an account of earlier disclosures from Monday and tied the evolving totals to ongoing withdrawals. The practical takeaway for traders, exchanges, and compliance teams is that large theft flows can remain active during the window between first public reporting and any coordinated countermeasures.
As the case develops, the key question will be whether additional on-chain and exchange-layer details can narrow down the alleged victim and confirm or refute claims about delayed disclosure. Readers should also watch for further updates that reconcile ZachXBT’s exchange-withdrawal figures with Bitquery’s wallet tracking—because the overlap (or lack of it) will shape how quickly funds can be identified for potential recovery or enforcement.
This article was originally published as ZachXBT Says Suspected EU Crypto Theft Estimate Reaches $133M on Crypto Breaking News – your trusted source for crypto news, Bitcoin news, and blockchain updates.
