ZachXBT Says Suspected EU Crypto Theft Estimate Reaches $133M

Blockchain investigator ZachXBT says a suspected crypto theft tied to an unidentified entity in the European Union has grown significantly, with the working total now exceeding $133 million. In a Tuesday update, he reported additional withdrawals from centralized exchanges after an initial disclosure the previous day.

The expanded figures matter because they suggest not only a larger immediate loss, but also that some of the outflows may have continued even while public investigations were beginning to circulate—potentially complicating later tracing and enforcement actions.

Key takeaways

• ZachXBT increased his estimate of the suspected EU-linked theft to more than $133 million after identifying an additional $27 million in withdrawals from centralized exchanges.
• The initial Monday report flagged $106 million in suspected losses, indicating the alleged outflows accelerated or continued after the first public warning.
• Bitquery reported rapid conversion of stablecoins into Ether, with $62.98 million converted into 27,553 ETH within roughly four hours.
• ZachXBT claims that the absence of a proper incident disclosure may have enabled over $30 million to be laundered before funds could be frozen.
• Investigators say the suspected laundering behavior may not align with patterns commonly associated with North Korea’s Lazarus Group, though the claims remain unverified.

Estimate rises as more exchange withdrawals are identified

ZachXBT’s latest update comes after he said he identified another $27 million in withdrawals from centralized exchanges on Tuesday. That brings his suspected total to more than $133 million, up from the $106 million he initially flagged on Monday.

In his Telegram post, ZachXBT noted that some withdrawals occurred after his primary disclosure. The implication for market watchers is straightforward: once large-scale theft suspicions enter public view, investigators and compliance teams often move quickly. If the additional withdrawals still happened afterward, it suggests the attacker had sufficient operational runway to keep transferring assets.

Centralized exchange outflows and rapid conversion to Ether

Separate analysis from Bitquery provides a snapshot of how some funds may have been processed soon after the alleged theft. Bitquery reported that $62.98 million in stablecoins was converted into 27,553 Ether (ETH) within roughly four hours.

Bitquery also described the situation in terms of what remained in tracked wallets and what had already been moved. As of 13:47 UTC on Monday, Bitquery estimated that about $78.3 million remained in wallets linked to the suspected attacker, while $30.5 million had moved out of the tracked addresses.

Stablecoin exposure appeared limited by that moment as well. Bitquery said only $3.74 million remained in USDC that Circle could potentially freeze—an important operational detail because stablecoin issuers and exchanges may only be able to take immediate action on specific holdings, depending on custody and compliance pathways.

Claims of attempted cover-up and what it means for enforcement

ZachXBT’s update was not limited to numbers. He offered a broader theory of intent, saying his “working theory” is that a large financial institution in Western Europe was exploited and that the incident is currently being covered up.

He further argued that the lack of a proper incident disclosure may have allowed more than $30 million to be laundered. According to ZachXBT, if authorities had received the right disclosure early enough, law enforcement could have frozen the funds. He added that the victim’s identity and the allegations of a cover-up are not verified.

For readers, the most consequential point here is the timing mechanism: in many theft cases, the gap between an incident and any formal disclosure or action can determine whether assets are still within reach. While the post asserts what could have happened under a disclosure scenario, it also highlights uncertainty around the underlying facts—what exactly was reported, when, and to whom.

How funds may have moved—and how that compares to known threat models

ZachXBT previously said the attacker was swapping funds into Ether and Monero (XMR) using instant exchanges and cross-chain bridges. In his Tuesday update, he also claimed the laundering patterns did not match those typically used by North Korea’s Lazarus Group.

This distinction matters because Lazarus-related intrusions have, in past incidents, been associated with particular operational characteristics. However, ZachXBT’s assessment is still a directional comparison rather than a definitive attribution. The underlying event remains framed as “suspected,” and neither the entity alleged to be involved nor the alleged perpetrator has been identified in a way that would conclusively settle the attribution question.

Even so, Bitquery’s observation of fast stablecoin-to-ETH conversion suggests that whoever controlled the wallets prioritized liquidity and speed—two factors that can align with a range of threat actors, including both organized crime groups and state-linked operations.

Meanwhile, ZachXBT referenced an account of earlier disclosures from Monday and tied the evolving totals to ongoing withdrawals. The practical takeaway for traders, exchanges, and compliance teams is that large theft flows can remain active during the window between first public reporting and any coordinated countermeasures.

What to watch next

As the case develops, the key question will be whether additional on-chain and exchange-layer details can narrow down the alleged victim and confirm or refute claims about delayed disclosure. Readers should also watch for further updates that reconcile ZachXBT’s exchange-withdrawal figures with Bitquery’s wallet tracking—because the overlap (or lack of it) will shape how quickly funds can be identified for potential recovery or enforcement.