An unidentified entity in the EU lost funds from several centralized exchange accounts on November 1, with the stolen assets withdrawn as USDC and USDT. On-chain investigator ZachXBT has now raised the estimate after tracing an additional $27M+ of exchange withdrawals by the same actor.

The total for the incident now stands at $133M+, and part of the withdrawals happened after the first public alert.

The attacker has been swapping USDC for ETH, moving funds through instant exchanges such as WellWallet and Kyrrex, converting to XMR via Wagyu and bridging across several chains. ZachXBT says laundering indicators point away from North Korea's Lazarus Group.

His working theory is that a large Western European financial institution was exploited and the breach is being covered up. Without a proper incident disclosure, $30M+ has already been laundered that EU law enforcement could otherwise have frozen.