Crypto theft: $106 million stolen from a European entity and converted into Monero

Coin Encyclopedia Improve your knowledge of cryptos

On-chain investigator ZachXBT revealed the matter on Monday, November 2, in a community alert. Its tracing reconstructs the journey of the funds, step by step.

The victim remains anonymous for now, an entity based in the European Union that held accounts on several centralized exchange platforms.

The starting point is a massive withdrawal of stablecoins, USDC and USDT, two tokens backed by the US dollar. The method used to empty the accounts remains unknown.

In the process, the attacker exchanged his USDC for ether. According to the Lookonchain analysis platform, the wallet behind these purchases acquired 27,553 ETH, or $62.97 million.

The loot then passed through instant exchange services, including Kyrrex and WellWallet. These platforms work like automatic exchange offices: you just have to deposit one asset there to leave with another.

Then comes the decisive step, with the conversion of funds into Monero (XMR), a “private” cryptocurrency which hides the sender, recipient and amount of each transaction, via the Wagyu service.

On Ethereum, each transfer is recorded in a ledger that anyone can read. This is what makes it possible to reconstruct the path of the funds, and when they enter Monero, the public trace stops dead.

In other words, the loot leaves a public account book for an opaque envelope, and that is probably why the thief chose it.

The attacker finally dispersed the assets via bridges, these tools that transport value from one blockchain to another. Such a route makes the recovery of funds “complex” for investigators.

The name Lazarus comes up as soon as a theft of this magnitude shakes crypto. This group of North Korean hackers is notably suspected of the Bitget hack, which cost $351.6 million at the end of September.

This time, the lead is ruled out, ZachXBT excluding the Lazarus group “with a high degree of confidence”, relying on several money laundering indicators. He does not yet specify what they relate to.

Investigators keep a hold, because eleven addresses linked to the case have been made public and the platforms can still monitor movements there.

The victim remains silent. It is difficult to know how the same attacker was able to reach several accounts on different platforms.

Machine-translated from French