Crypto: Kraken freezes accounts after a $133 million theft in Europe

Coin Encyclopedia Improve your knowledge of cryptos

Investigator ZachXBT raised his estimate today, November 3, after identifying approximately $27 million in additional withdrawals. His hypothesis of a West European financial institution being the victim of an attack remains unconfirmed at this time.

In its response to Cointelegraph, Kraken clearly distinguishes the initial incident from the possible passage of funds on its platform. The company says its security systems have not been compromised and there are no current risks to its customers. It does not specify either the number of restricted accounts or the amounts immobilized.

Crypto.com also says it has taken steps to prevent funds associated with this third-party incident from circulating on its platform. For its part, OKX said it was examining the file.

Bitquery's updated analysis traces $108.8 million in USDC withdrawn from accounts with these three platforms between November 1 and 2. This amount does not constitute an independent validation of the total of 133 million advanced by ZachXBT: Bitquery limits its investigation to movements identified on Ethereum.

Analysts also note that several recipient addresses had already received funds from the same platforms before the incident. They therefore envisage a compromise on the side of the account holder or their wallets, without being able to determine the exact cause.

According to Bitquery, $62.98 million worth of stablecoins were converted into 27,553 ETH in approximately four hours. This conversion reduces the possibilities of blocking by issuers: unlike USDC or USDT, ETH does not have a freezing function controlled by a company.

In its November 3 statement at 08:47 UTC, Bitquery still identified approximately $71.33 million in addresses attributed to the alleged attacker. Tether had frozen around 1.14 million USDT. These figures remain linked to this moment of observation and may change with transfers and courses.

ZachXBT believes that insufficient communication delayed the possibility of intervention and suspects a desire to cover up the matter. This accusation is not proven. The absence of a public announcement also does not prove that no confidential declaration was made to the authorities.

Without knowing the identity and status of the victim, it would therefore be premature to conclude that there was a regulatory breach. The available elements above all establish significant suspicious movements and measures taken by several platforms. The origin of the incident and the extent of the recoveries remain to be documented. No doubt we will talk about it again in the coming days.

Machine-translated from French