An illicit actor withdrew the suspected stolen funds as USDC and USDT from multiple centralized exchange accounts belonging to an unnamed EU entity on November 1, on-chain investigator ZachXBT flagged in a community alert. The victim has not been identified publicly.

The suspected loss exceeds $106M, spread across 11 theft addresses.

Over the following 24 hours the attacker aggressively swapped USDC for ETH, sent funds to instant exchanges such as WellWallet and Kyrrex, converted part of them to Monero via Wagyu and bridged across multiple chains.

The move into XMR sharply reduces the chances of tracing or freezing the funds, since stablecoin issuers can only block assets that remain in USDC or USDT.