Possible $106 million theft from a European entity’s accounts
More than $106 million has reportedly been lost, but who lost the money and how remains unknown.
An unidentified entity in the European Union may have lost more than $106 million from accounts on several crypto exchanges on November 1, 2026. The case was brought to light by blockchain investigator ZachXBT, but neither the alleged victim nor any exchange has publicly confirmed the possible theft. How the funds were accessed remains unknown.
What do we know about the $106 million?
The estimate of losses above $106 million involves USDC and USDT, two stablecoins, that is, cryptocurrencies designed to hold a value of one dollar. According to BeInCrypto’s coverage on November 2, the alleged perpetrator withdrew the funds from accounts on more than one exchange.
BeInCrypto’s review of Ethereum transactions found about $80 million in USDC ending up in 11 wallets within 11 hours. In five of them, about $9.6 million was moved again within three minutes. The $80 million refers to the USDC portion, not the total estimated loss, which also includes USDT.
There is also a detail that complicates the investigation: at least five of the flagged wallets had received smaller amounts from the same source months earlier. That raises questions, but it doesn’t prove when or how any breach took place.
Why were the stablecoins converted into ETH and Monero?
Converting stablecoins into other cryptocurrencies can make it harder both to freeze and to track the funds. Circle and Tether, the issuers of USDC and USDT respectively, can freeze their tokens. ETH has no equivalent central issuer.
According to ZachXBT, the alleged perpetrator swapped USDC for ETH and routed funds through instant exchange services, including WellWallet and Kyrrex. They also used Wagyu to convert part of the funds into Monero (XMR), while other amounts were moved across different blockchains.
Monero hides transaction details, making tracing harder. Think of a journey where you keep switching modes of transport: each switch adds work for anyone trying to follow the money. That alone, however, is not evidence of the perpetrator’s identity.
Are exchange users in Greece at risk?
There is currently no public evidence of a wider breach affecting ordinary exchange customers in the EU. For users in Greece, then, the news does not show that their own account has been exposed.
The precautions BeInCrypto lists include checking recent activity, removing unknown API keys and enabling two-factor authentication, preferably with passkeys or an authenticator app. Where available, restricting withdrawals to whitelisted addresses is recommended. Suspicious activity should be reported to the exchange right away through its official channels.
What do we take away from the case?
The crucial distinction is between a possible theft from one entity’s accounts and a confirmed breach of the exchanges themselves. In our view, that difference should not get lost behind the large sum.
The transfers give investigators a money trail, not yet a full explanation of the incident. We are waiting for the victim to be identified, confirmations from the platforms involved and details about the initial access. Until then, neither panic nor the certainty that “this doesn’t concern us” helps.