ZachXBT flags suspected $106M exchange theft, while a Solana bot wallet may have lost $786K

Blockchain investigators are tracking two separate crypto losses: a suspected theft of more than $106 million from accounts at multiple cryptocurrency exchanges in the European Union, and a wallet tied to Solana arbitrage bot King that may have lost about $786,000. For PSPs and exchange operators, the useful part is not the drama; it is the movement pattern, which shows how quickly funds can be split across exchanges, chains, and swap services.

1. On Monday, ZachXBT said an unidentified entity in the European Union may have lost more than $106 million on Sunday from accounts at multiple cryptocurrency exchanges. The funds were reportedly withdrawn in USDC and USDT, then moved through several cryptocurrencies and blockchains.
2. According to ZachXBT, the suspected attacker swapped USDC for Ether (ETH), used instant exchange services including WellWallet and Kyrrex, and then converted funds into Monero (XMR) through the swap service Wagyu. ZachXBT identified 11 wallet addresses associated with the funds.
3. ZachXBT said the movement of funds pointed away from a link to North Korea’s Lazarus Group. The affected entity and the exchanges involved have not been publicly named, so the public record is still missing the two things operators usually want first: the counterparty and the venue.
4. The report comes after the $6.3 billion Binance hack on Oct. 29, which the FBI attributed to North Korean hackers known as “TraderTraitor,” a group linked to Lazarus. That attack was the largest cryptocurrency theft on record.
5. Separately, a wallet associated with King, an automated trading bot on Solana, may have lost about $786,000 on Monday, according to pseudonymous blockchain monitoring account Onchain Lens. Onchain Lens said the funds moved through several Solana wallets before being transferred to Ethereum using Mayan, a service for moving assets between blockchains.

King is an arbitrage bot, meaning software that automatically buys cryptocurrency in one market and sells it in another to capture price differences. In this case, Onchain Lens told Cointelegraph that the rapid transfers and cross-chain movement suggested an attempt to obscure the funds’ origin and pointed to a possible wallet compromise; King’s operator has not confirmed that.