On November 2, on-chain detective ZachXBT suddenly issued an alert on social media and Telegram to the community, stating that more than $106 million in assets was withdrawn, split, and transferred from accounts of multiple centralized exchanges in just about 24 hours. The suspected victim is an unnamed "EU entity." According to his disclosure, these funds were originally sitting in multiple CEX accounts in the forms of USDC and USDT around November 1, and were quickly withdrawn in batches, first exchanged for ETH, and then flowed into instant exchange or trading platforms such as WellWallet and Kyrrex, before being further fragmented and transferred to more addresses using cross-chain tools. While suspected stolen assets evaporated rapidly on-chain, after ZachXBT disclosed relevant addresses and transfer paths, both Chinese and English media quickly followed up with reports. However, so far, no involved exchange or regulatory body has issued any announcements or provided a final qualification for this incident, which remains stuck in a narrative of "suspected account compromise," exposing the tense and ambiguous boundary between centralized account security and public on-chain tracing.

In 24 hours, $106 million was split and transferred away

According to the on-chain path disclosed by ZachXBT, starting from November 1, multiple centralized exchange accounts suspected to belong to "a certain EU entity" began to show large withdrawal records simultaneously, with the assets being primarily documented in USDC and USDT. In just a few hours, these funds, which were originally sitting in different accounts, were continuously withdrawn in single transactions and in quick succession, ultimately exceeding $106 million departing the exchange system within an approximate 24-hour window, completing a key action of the first step of "de-custody."

After leaving the exchanges, the funds did not remain in a few receiving addresses but were quickly exchanged in batches and routed to different platforms: some USDC and USDT were converted to ETH, which were then sent to instant exchange or trading places like WellWallet and Kyrrex. At the same time, other accounts were executing similar operations, forming a network of multi-address and multi-platform splitting. For trackers, this means that each withdrawal link was soon cut into new output paths, creating complex mesh structures of on-chain traces in a short time, showing obvious characteristics of prior planning and skilled management, making the $106 million evolve from “a few large abnormal withdrawals” into a fragmented capital flow challenging to map back to the original accounts.

From USDC to ETH: A layered money laundering path

Following the path disclosed by ZachXBT, the USDC and USDT withdrawn from multiple centralized exchange accounts were quickly exchanged for ETH on-chain. Compared to the originally dollar-denominated assets, ETH has ready trading pairs in more chains and on more platforms, allowing skilled attackers to use it as a transit asset to open up as many exits as possible in a short time. This explains why, within the approximate 24-hour window, the vast majority of abnormal withdrawals ultimately converged on the critical step of "USDC/USDT → ETH," transforming assets that could easily be matched with fiat currency deposit and withdrawal records into more universally circulating tokens in cross-chain operations.

But the path did not terminate at ETH. Multiple media outlets cited ZachXBT's remarks pointing out that the converted ETH continued to be sent to instant exchange or trading platforms like WellWallet and Kyrrex, where they were further split, exchanged for other coins, and then directed to different chains and new addresses using cross-chain tools, extending and dispersing the on-chain traces layer by layer. Some reports further claimed that a portion of the funds might have been exchanged into the privacy coin XMR via Wagyu; however, this link is currently only seen from a single source, lacking further on-chain evidence, still requiring annotation as "to be verified," indicating that the true direction of these funds remains merely a partially filled puzzle for the outside world.

EU entities become targets: Security of several CEX accounts questioned

In this incident, the victim has been deliberately obscured as "a certain EU entity," not disclosing the company name or stating the type of business or whether it holds a license, which instead amplifies the imaginative space for public opinion. To the outside world, "EU entity" naturally carries associations of compliance and regulation—once linked with the suspected $106 million abnormal withdrawals, it implies that this is no longer just a story of a personal account being hacked, but could symbolize a significant case of institutional-level risk management failure, even though no official documents currently confirm this implication.

From the publicly available on-chain paths and the information disclosed by ZachXBT, this "EU entity" has accounts set up at multiple centralized exchanges, used to withdraw USDC and USDT in bulk, and then swiftly exchanged for other assets along the previously mentioned paths. Because it involves multiple CEX accounts, rather than a single login entry on one platform, the outside world finds it difficult to simply blame one exchange for "system being hacked," nor can it rule out possibilities such as the account party's own weak security management, social engineering attacks, or internal operational oversights. Currently, no specific exchange has been named or has acknowledged experiencing a breach, and media and communities continue to use terms like "suspected theft" or "suspected account compromise," leaving the truth of the incident in a temporarily gray area under multiple uncertainties.

On-chain detective takes the initiative, exchanges respond passively

While the truth of the incident remains in a gray area, on November 2, ZachXBT took the lead in breaking the silence—he issued an alert to the community via his personal social media and Telegram channel, posting suspected related addresses and the paths of fund transfers: large withdrawals of USDC and USDT from multiple centralized exchange accounts, exchanged for ETH in batches within about 24 hours, and continuing to flow to instant exchange or trading platforms like WellWallet and Kyrrex, further split and transferred using cross-chain tools. Some media further mentioned that one segment of the path was suspected to have been changed into the privacy coin XMR via Wagyu, but this detail is still noted as "to be verified." After the entire pathway was made public, it was quickly referenced and reported by multiple Chinese and English crypto media outlets, transforming the incident from a secretive conflict between exchanges and "a certain EU entity" into a typical "community safety alert": the information first took shape on-chain and social platforms, then compelling traditional institutions to respond.

In contrast, until ZachXBT disclosed the details and the media amplified the reports, no exchange involved had provided a detailed explanation of the incident or a clear timeline in the publicly available materials, nor was there any unified qualification from official channels. In an environment interwoven with multiple chains and tools, on-chain tracing can depict the general direction of funds in almost real-time, but the risk control and compliance teams of various centralized exchanges often can only see a small portion of records within their own systems; it requires internal checks, legal evaluations, and external coordination before they might be able to speak out. The fragmentation of perspectives across multiple exchanges, platforms, and chains makes it difficult for them to immediately put together the same map as on-chain detectives like ZachXBT, and this discrepancy in rhythm and perspective is a structural reason for the lag of exchange announcements compared to the proactive on-chain intelligence in such "suspected theft" incidents.

The gray area of cross-chain and privacy coins, how can regulation keep up?

The suspected incident of "a certain EU entity" experiencing abnormal withdrawals from multiple centralized exchange accounts reveals not a single platform's risk control oversight, but rather a structural gap between CEX account security boundaries and on-chain money laundering paths: once USDC and USDT are withdrawn from the accounts and exchanged into ETH in batches within about 24 hours, flowing into instant exchange platforms such as WellWallet and Kyrrex, and then compounded with cross-chain tools and privacy coins, the funds rapidly slide from a compliance perspective into a regulatory gray area that is difficult to cover. According to the publicly available chains, these funds were subsequently split and transferred using cross-chain tools, with some media reporting that a portion might have been exchanged for the privacy coin XMR via Wagyu, but this detail remains to be verified; this multi-layer structure of "multiple CEX withdrawals—instant exchanges—cross-chain—privacy coins" has appeared in previous hacker attacks and account theft incidents but still lacks a clear legal and technical response framework. More challenging is that, as of now, no EU or other regional regulatory body has issued investigation notices or enforcement progress regarding this case, and market participants and compliance teams mainly rely on the addresses and paths disclosed by on-chain analysts like ZachXBT, as well as ongoing media tracking. In this context, the key variables to observe moving forward will be: whether the involved exchanges will disclose more internal investigation information, whether law enforcement will formally intervene and provide qualifying conclusions, and how far community on-chain tracking can advance this intertwined path of cross-chain and privacy coins in the absence of an official report.

Join our community to discuss together and grow stronger!
AiCoin exclusive Hyperliquid benefits: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin exclusive Aster benefits: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。