An anonymous European Union-based entity lost more than $106 million in crypto assets (around Rp1.67 trillion) on Sunday (1/11). Onchain investigator ZachXBT revealed that the perpetrator drained the funds in the form of USDC and USDT stablecoins from multiple centralized exchange (CEX) accounts. Once the assets were withdrawn from the exchanges, the culprit aggressively moved to launder the funds within 24 hours to avoid unilateral freezes by stablecoin issuers.
The perpetrator’s swift execution was crucial in securing the stolen proceeds against asset seizures.
Swapping 27,553 ETH and Entering the Privacy Coin Route
The perpetrator split the laundering process into several separate transfer routes. Through wallet address 0x9eca, the attacker swapped USDC holdings into 27,553 ETH worth $62.97 million at an average price of $2,286 per token. This large-scale conversion into Ethereum was completed within the first 24 hours of withdrawal, coinciding with efforts to avoid the risk of unilateral freezes by stablecoin issuers.
The perpetrator also utilized instant exchange services without strict identity verification (KYC), including WellWallet and Kyrrex. Another portion of the funds was converted into the privacy coin Monero (XMR) via the Wagyu swap platform. The stolen assets were then transferred and bridged across several different blockchains. Throughout this sequence of transfers, ZachXBT identified 11 wallet addresses affiliated with the movement of the laundered funds.
Why the Perpetrator Is Not the Lazarus Group
The nine-figure heist initially sparked speculation regarding the involvement of the North Korean cyber hacking group, Lazarus Group. However, ZachXBT asserted with a high degree of confidence that the perpetrator laundering the funds this time is not part of the state-backed hacking collective. That conclusion was based on an in-depth analysis of transaction patterns and money laundering infrastructure, which differed from Lazarus’s regular operational playbook.
To date, neither the identity of the EU victim entity nor the names of the CEXs from which the funds were drained have been publicly disclosed. It also remains uncertain whether any portion of the funds was successfully frozen by stablecoin issuers before the perpetrator completed the entire swapping process.
A String of Major Exploits in a Single Week
This nine-figure incident occurred just days after a record-breaking $6.3 billion breach at Binance and a withdrawal freeze at Brazilian exchange Mercado Bitcoin following a $40 million exploit.
For crypto market participants, this incident illustrates that centralized exchange accounts remain targets for massive-scale breaches, while rapid conversions into various digital assets provide an opening for perpetrators before freeze actions can be taken.
Reported via Decrypt.
Also read: FBI States North Korea Responsible for $6.3 Billion Binance Hack - Funds Flow into DeFi Channels
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
