Blockchain investigators have flagged two possible cryptocurrency losses: an unidentified European entity may have lost more than $106 million from accounts at multiple exchanges, while a wallet associated with a Solana arbitrage bot may have lost about $786,000.
The suspected $106 million theft was flagged by blockchain investigator ZachXBT, who said funds suspected to have been stolen were withdrawn in USDC and USDT before being moved through several cryptocurrencies and blockchains. The suspected attacker swapped USDC for Ether, used instant exchange services WellWallet and Kyrrex, and converted funds into Monero through swap service Wagyu. ZachXBT identified 11 wallet addresses and said the movement of funds pointed away from a link to North Korea's Lazarus Group. The affected entity and exchanges have not been named.
The theft comes days after the $6.3 billion Binance hack of Oct. 29, which the FBI attributed to North Korean hackers known as "TraderTraitor", a group linked to Lazarus. That attack was the largest cryptocurrency theft on record.
A separate incident involved a wallet associated with King, an automated arbitrage bot on Solana, which may have lost about $786,000. Monitoring account Onchain Lens told Cointelegraph the funds moved through several Solana wallets before being transferred to Ethereum. "Our report is based on unusual fund movements, rapid transfers and the subsequent cross-chain movement of funds, which we believe indicates an attempt to obscure their origin," Onchain Lens said. "This pattern strongly suggests a potential wallet compromise." The bot's operator has not confirmed a compromise.
Analysis
Why This Matters
- The $106 million sum underscores persistent security risks in the crypto exchange sector.
- The use of cross-chain swaps and privacy coins shows sophisticated money-laundering tactics.
- The Solana bot incident highlights risks in automated trading systems.
Background
- The crypto industry has seen a series of high-profile heists, with the $6.3 billion Binance hack on Oct. 29 being the largest recorded.
- ZachXBT is a blockchain investigator known for tracking stolen funds.
Key Perspectives
ZachXBT: The $106M theft does not appear linked to North Korea's Lazarus Group.
Onchain Lens: The Solana bot fund movements suggest a wallet compromise.
King's operator: Has not confirmed a compromise.
What to Watch
- Whether the affected European entity or exchanges come forward.
- Potential recovery efforts for the stolen funds.
- Further scrutiny of automated arbitrage bots.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedThe suspected crypto theft involved more than $106 million.Cointelegraph.com News: “An unidentified entity in the European Union may have lost more than $106 million from accounts at multiple cryptocurrency exchanges on Sunday, according to blockchain investigator ZachXBT.”
- SupportedA wallet associated with a Solana arbitrage bot may have lost about $786,000.Cointelegraph.com News: “A wallet associated with King, an automated trading bot on Solana, may have lost about $786,000 on Monday, according to pseudonymous blockchain monitoring account Onchain Lens.”
- SupportedThe story reports two possible losses involving funds moved across exchanges and blockchains.Cointelegraph.com News: “The suspected attacker swapped USDC for Ether (ETH), used instant exchange services including WellWallet and Kyrrex, and converted funds into Monero (XMR) through the swap service Wagyu.”
- SupportedFunds suspected to have been stolen were withdrawn in USDC and USDT, then moved through cryptocurrencies and blockchains.Cointelegraph.com News: “In a Monday post, ZachXBT said funds suspected to have been stolen were withdrawn in USDC and USDT before being moved through several cryptocurrencies and blockchains.”
- SupportedZachXBT identified 11 wallet addresses associated with the funds.Cointelegraph.com News: “ZachXBT identified 11 wallet addresses associated with the funds.”
- SupportedZachXBT said the movement of funds pointed away from a link to Lazarus Group.Cointelegraph.com News: “The suspected attacker remains unidentified, though ZachXBT said the movement of funds pointed away from a link to North Korea’s Lazarus Group.”
- SupportedThe affected entity and exchanges have not been named.Cointelegraph.com News: “The affected entity and exchanges involved have not been publicly named.”
- SupportedThe suspected theft followed the Oct. 29 Binance hack, which the FBI attributed to North Korean hackers known as “TraderTraitor.”Cointelegraph.com News: “The reported theft follows the $6.3 billion Binance hack on Oct. 29, which the FBI has attributed to North Korean hackers known as “TraderTraitor,” a group linked to Lazarus.”
- SupportedThe Binance attack was the largest cryptocurrency theft on record.Cointelegraph.com News: “The attack was the largest cryptocurrency theft on record.”
- SupportedOnchain Lens said: “Our report is based on unusual fund movements, rapid transfers and the subsequent cross-chain movement of funds, which we believe indicates an attempt to obscure their origin,”Cointelegraph.com News: ““Our report is based on unusual fund movements, rapid transfers and the subsequent cross-chain movement of funds, which we believe indicates an attempt to obscure their origin,” Onchain Lens told Cointelegraph.”
- SupportedOnchain Lens said: “This pattern strongly suggests a potential wallet compromise.”Cointelegraph.com News: ““This pattern strongly suggests a potential wallet compromise.””
- SupportedThe bot’s operator has not confirmed a compromise.Cointelegraph.com News: “King’s operator has not confirmed a compromise.”
