Key Takeaways:
- An anonymous EU firm could have lost over $106 million in various exchanges.
- The suspected attacker transferred USDC and USDT into ETH and XMR and cross-chain.
- Another Solana arbitrage bot known as King was singled out and slashed for approximately $786,000.
Crypto investigators continue to monitor two huge security breaches, totaling over $106 million in suspected stolen funds and another $786,000 worth of funds drained from an aging Solana trading bot.
The bigger case is still open but the victim and the exchanges and attacker still were not identified.
EU Entity May Have Lost Over $106M in Crypto
Blockchain investigator ZachXBT said an unnamed EU entity is suspected of losing more than $106 million from accounts held at several centralized crypto exchanges on Nov. 1.
Presumptive stolen funds were siphoned off at first in terms of USDC and USDT. ZachXBT released 11 addresses that were associated with the activity, but did not disclose any of the victims or how exchange accounts were opened.
The operant suspected attacker then rapidly reconfigured the asset trail during the next 24-hours.
In addition to USDC being swapped into ether, there were also funds transferred via instant exchange platforms like WellWallet and Kyrrex. Using Wagyu some assets were converted into privacy coin Monero, other assets moved over several blockchain networks.
Read More: Binance $6.3B Hack Triggers FBI Probe While $3B in Stolen Crypto Gets Frozen
ZachXBT Rules Out Lazarus Group
The laundering activity does not seem to follow one of the patterns seen with the North Korea-related Lazarus Group, ZachXBT further said. Although who did the actual theft has not been determined, he said he had a “high degree of confidence” that it was not made by Lazarus.”
The particular is significant, as it comes after the big cyber breakout of cryptocurrencies occurred recently and brought North Korean cyber gangs back into the spotlight. There is, however, no evidence of the EU incident being related to those operations at the moment.
Stolen Funds Move Beyond Freezable Stablecoins
The transition towards stablecoins to ETH and XMR might hinder recoveries. The USDC/USDT issuers are able to freeze tokens on certain addresses; assets like Ether do not have a centralized issuer with similar capabilities. Monero poses yet another challenge as the Privacy features of the platform strip all the details away from transactions.
The speed of using instant exchanges and cross-chain bridges also makes the money trail more complex, allowing investigators to trace activity through various networks and services.
The EU firm in question and the exchanges in question have not confirmed this lack of funds.
Read More: Binance $5.5B Hack Exposed: 50 EIP-7702 Nonces Opened One Hot Wallet in Minutes
Solana MEV Bot King Loses Another $786K
Another incident struck older Solana arbiter King, one of the network’s automated trading bots. Onchain Lens stated that the bot lost approximately $786,000, comprising approximately 4,260 WSOL, 191 SOL and $366,000 worth of stablecoins. Prior to the incident, King had reported to have made about $7.2 million in lifetime profits.
SOLANA MEV BOT KING DRAINED OF $786K 💀
King, one of Solana’s oldest arbitrage bots with $7.2M in lifetime PnL, was drained of ~$786K, including 4.26K $WSOL, 191 $SOL and $366K in stablecoins.
Drainers:
BHRayETPjvgg3BCr9H82V1D6NRwxu5v44JAaVuaod3jUForwarder:
Ddmy5oM8xtTs1EBC6eF2SZwQfBreewQpFgtUDm51HkqjVictim: 7dGrdJRYtsNR8UYxZ3TnifXGjGc9eRYLq9sELwYpuuUu
— Onchain Lens (@OnchainLens) November 2, 2026
Onchain Lens was also able to locate the suspect drainer wallet, forward wallet, and the victim wallet’s address. It’s not yet been revealed what specific way was used to access the monitoring account and if the wallet was compromised through this or a different means.
