Unknown attackers moved 106 million USDC and USDT from European company addresses

The incident took place on November 1, and the technical details have not been disclosed by ZachXBT. What matters for payment teams is the post-theft flow: the attackers are already using exchanges, cross-chain movement, and privacy coins to make the funds harder to trace and freeze.

1. ZachXBT said the stolen funds totaled 106 million USDC and USDT. He also said the attackers are not connected to North Korean hackers, and that the laundering pattern does not resemble the methods usually associated with Lazarus.
2. Over the last 24 hours, the attackers have been actively covering their tracks by converting USDC into ether and routing assets through exchangers, including WellWallet and Kyrrex. According to the same report, they are also buying Monero (XMR) with stablecoins via Wagyu.
3. The published flow shows the attackers moving assets across different blockchains to make transactions harder to trace and stablecoins harder to freeze. In practice, that is the part PSPs and exchanges watch for first: once the funds are spread across chains, the clean-up work gets messy fast.
4. The theft came two days after the largest hack in crypto company history: the Binance exchange breach, which caused about $6.3 billion in damage. Binance said it has covered 95% of the loss from its own funds, while the remaining 5% relates to less liquid tokens that it is still buying.
5. In that separate case, hackers tied by the FBI to North Korea began laundering the proceeds and moving them into ether using 11 blockchains, around 12,000 wallets, and more than 40,000 transactions, according to blockchain analysts. A significant share of the funds went through Tron, and asset issuers and other platforms managed to block only 44% of the stolen cryptocurrency.