Investigators Probe Suspected $106M Crypto Theft and $786K Solana Bot Drain

European authorities and exchange users are watching closely after blockchain investigator ZachXBT alleged that an unidentified entity in the European Union suffered losses exceeding $106 million in a multi-exchange cryptocurrency theft on Sunday. In a Monday post, ZachXBT described a chain of swaps, cross-chain moves, and rapid conversions designed to obscure the stolen funds.

The same period also brought fresh concerns for Solana traders: Onchain Lens said a wallet linked to “King,” an automated arbitrage bot on Solana, may have lost roughly $786,000. While neither case has resulted in publicly confirmed attribution to a specific actor, both reports highlight how quickly attackers are moving funds across ecosystems.

Key takeaways

• ZachXBT alleges more than $106 million was withdrawn and routed through multiple exchanges, with stolen value cycled through USDC/USDT, Ether, and then Monero.
• The suspect activity reportedly used instant exchange services including WellWallet and Kyrrex, and later converted funds to Monero via Wagyu.
• ZachXBT said the observed movement did not appear to align cleanly with a link to Lazarus Group, though the attacker remains unidentified.
• Onchain Lens reported that a King arbitrage-bot wallet may have lost about $786,000, citing rapid Solana wallet transfers followed by a bridge to Ethereum.
• The bot operator has not confirmed whether any compromise occurred, underscoring the uncertainty around attribution in these incidents.

$106M alleged theft: stablecoins to ETH, then to Monero

According to ZachXBT, the alleged theft involved funds withdrawn in USDC and USDT, which were then moved through several cryptocurrencies and blockchains. The investigator described a progression aimed at both liquidity and obfuscation: first, the funds were swapped into Ether (ETH); then they were routed via instant exchange services such as WellWallet and Kyrrex.

In the later stages of the flow, ZachXBT said the attacker converted funds into Monero (XMR) using the swap service Wagyu. Monero is commonly associated with enhanced privacy relative to many major assets, and its use often signals an attempt to reduce traceability once value reaches certain stages of a laundering pipeline.

ZachXBT also identified 11 wallet addresses connected to the movement of funds. Still, the affected entity and the specific exchanges involved were not publicly named in the report, limiting what outside observers can immediately verify and what affected customers can do in the short term.

What ZachXBT says points away from Lazarus

While large-scale crypto thefts are frequently compared to prior high-profile campaigns, ZachXBT said the pattern of fund movement “pointed away” from a direct link to North Korea’s Lazarus Group. The investigator did not provide additional technical details in the excerpt beyond the flow described—swaps, instant exchanges, and a final conversion to Monero.

This matters because Lazarus-linked operations have become a baseline risk reference for industry participants, especially after recent record thefts. However, in fast-moving incidents like these, similarities in tooling can be misleading: attackers may reuse infrastructure across different campaigns, or the publicly observable flow may be shaped as much by routing choices as by the attacker’s identity.

Context: after Binance’s record hack, investigators see more cross-chain speed

ZachXBT’s allegations arrive after the widely reported $6.3 billion Binance hack on Oct. 29. Cointelegraph previously reported that the FBI attributed that breach to North Korean hackers associated with a group reportedly linked to Lazarus, dubbed “TraderTraitor,” describing it as the largest cryptocurrency theft on record.

That backdrop helps explain why market watchers are emphasizing speed and cross-chain complexity. Both the reported $106 million incident and the separate Solana bot-linked loss described below reflect a broader theme: attackers aim to move funds quickly enough to reduce the chance of real-time blocking, while also shifting through assets and networks to complicate tracing and enforcement.

King arbitrage bot wallet: possible $786K loss on Solana

Separately, Onchain Lens said a wallet associated with “King,” an automated arbitrage bot operating on Solana, may have lost around $786,000 on Monday. The monitoring account described a multi-step movement: funds allegedly moved through several Solana wallets before being transferred to Ethereum using Mayan, a service for moving assets between blockchains.

Onchain Lens characterized the rapid transfers as a sign of attempted concealment of the funds’ origin. In its communication to Cointelegraph, the firm pointed to “unusual fund movements,” short time windows between transfers, and then cross-chain movement—elements it said “strongly suggests a potential wallet compromise.”

At the time of the report, King’s operator had not confirmed that a compromise occurred. That distinction is important for readers: arbitrage systems can involve frequent fund movement by design, and without operator verification, observers must rely on behavioral patterns rather than definitive evidence.

Why these reports matter for users and investors

Taken together, the two incidents underscore how today’s most damaging crypto attacks often blend ordinary finance mechanics—swapping, routing, bridging—with operational tactics that make attribution harder. For exchange users, the $106 million allegation highlights the importance of withdrawal monitoring, post-incident tracing, and customer protections—especially when attackers can exit quickly through stablecoin liquidity and instant exchange interfaces.

For builders and traders relying on automated strategies, Onchain Lens’ report raises a parallel question: if a bot-controlled wallet can be compromised or misused, the cost can be both immediate and hard to recover, particularly once funds are bridged to other networks. Even in cases where operators deny or have not confirmed a breach, the observable on-chain behavior can still be relevant for risk assessment and security response.

What readers should watch next is whether affected parties name the specific exchanges, whether analysts publish additional address-level tracing beyond the wallet lists already referenced, and whether the King operator—or any security researchers—confirms whether a compromise occurred and what protections were bypassed.