$108.8M left three exchange accounts in 21 hours. Most of it still sits on Ethereum, in wallets anyone can watch
The money left through addresses the victim already trusted. We followed it into 229 wallets to see where it went, and how much can still be stopped.
- $108.8M
- 11 of 15
- $78.3M
- 27,553 ETH
- $28.00M
- $3.7M
01 · What happenedWhat happened in the $106M crypto theft
On Sunday, 1 November, a European crypto holder lost over $100 million in an apparent theft. The money left its accounts at Kraken, Crypto.com and OKX. It went out as USDC, a digital dollar, over about 21 hours. Most of it went first to addresses those exchanges had paid before. Within minutes, it moved on to new ones nobody had seen before.
On Monday, a post by Officer's Notes said the on-chain sleuth ZachXBT had flagged a suspected theft of more than $106 million from an EU entity. The post listed 11 addresses. It said the thief was swapping USDC for ETH, sending money through instant exchanges and turning some of it into Monero, a privacy coin. A graph from the analytics firm TRM went with it.
Bitquery records every transfer on Ethereum, so we followed the money from those 11 addresses, and back to where it came from. We count $108.80M withdrawn to 15 wallets, four more than the list named. Most of it has not gone far. At 13:47 UTC on 2 November, $78.27M still sat in addresses we tie to the thief, mostly as ETH. We also found that eight of the 11 listed addresses look like the victim's own wallets, because the exchanges had paid them before the theft.
02 · The setupHow the money got out of the exchanges
The exchanges paid 15 wallets. Eleven of them had been paid by the same exchanges before, two of them since May. They got 84% of the money. Whoever moved it on had the keys to those wallets too.
The other four were new that day and took $17.27M. The very first payments from OKX and from Kraken both went to new wallets. Many exchange accounts can lock withdrawals to a short list of approved addresses, called an allowlist. If the accounts used an allowlist, the thief was able to add to it. If they had none, the thief could send money anywhere.
From there the money split three ways. Most was swapped into ETH, some became DAI, a stablecoin with no freeze button, and the rest left through exchange deposits, bridges to other chains and instant swap services.
03 · The dayTwenty-one hours of withdrawals
The first withdrawal left OKX at 12:25 UTC on Sunday. Kraken followed 44 minutes later and ended up paying 95% of the total. Withdrawals built up through the afternoon and peaked in the evening.
In the three hours to 23:00 UTC, $73.2M left, two thirds of the total. By 23:10 UTC, 98% was gone. The rest went out overnight, nearly all of it to one wallet, 0xd3c1…a7c1. The final payment landed on Monday morning.
The money did not sit still. The median wait before the USDC moved on to a fresh wallet was three minutes, and ten of the 13 that got large payments passed them on within 15 minutes. One new wallet took 43 Kraken withdrawals in 91 minutes, each under $50k. That looks like the thief working around a limit on each withdrawal.
04 · The walletsMost wallets on the list look like the victim's
Eleven of the 15 have a history. The oldest, 0x730b…3992, took its first Kraken withdrawal on 4 May. It took 48 more before the theft and paid the money on to other addresses, much as a business pays its suppliers. Another, 0x90f0…c557, took $858k from Kraken in October and spent it within days.
They also paid each other before the theft. Three of them sent USDC to the oldest one over the summer. Two others paid the same outside addresses in October. One owner most likely ran them all.
Both sides used the same kind of wallet. Of the 15, 8 are Trust Wallet smart accounts, set up to pay their network fees in USDC, and so are 20 of the thief's addresses. Millions of people use Trust Wallet, and nothing here points to a flaw in the app. The shared setup fits one person or team handling both sets of keys.
Three of the 11 posted addresses were new on 1 November. The posted list also left out four addresses that took $28.00M between them. One of those, 0xe944…8cb9, does appear in TRM's graph.
The thief likely had both the exchange logins and the keys to wallets the victim had used before. That points to a break-in on the owner's own devices or wallet setup, or to someone inside the victim's own team. The chain alone cannot tell those apart.
05 · The victimWhat the wallets say about the victim
We could not name the victim. None of the 15 appears in our address labels, none has an ENS name, a readable wallet name, and no public post we found ties them to a company.
The owner has used Kraken since May, Crypto.com since October and OKX as well. Between 20 October and 1 November, two of the 15 also paid deposit addresses of a service that TRM's graph tags as Kyrrex, a European exchange. The owner likely had an account there too. The wallets swapped tokens on-chain and paid dozens of other addresses, often in round sums.
That looks like a trading or payments business run from everyday crypto wallets, rather than a fund that keeps its coins with a custody firm. We hold that view loosely. Kraken, which paid 178 of the withdrawals, can say for sure who owns the account.
06 · The swapInto ETH before anyone could freeze it
Circle, the company behind USDC, can freeze the coins at any address. ETH has no such switch. So the thief's first job was to swap.
Just before midnight UTC, a fresh wallet started selling stablecoins through UniswapX. That is an auction where market makers, the trading firms that quote prices, compete to fill your trade. A large order gets done fast and near the market price. Within about four hours it had sold $62.98M of USDC and USDT for 27,553 ETH, about $2,286 each.
Another branch of the theft swapped its USDC into DAI instead. Circle did not freeze any of the thief's USDC during the sale, or by our check on Monday. After the Binance hack last week, Tether and Circle froze more than $2 billion within hours. Here the swap ran for four hours with no freeze at all. We do not know whether anyone asked Circle to act.
07 · The money nowWhere the $108.8M is now
Most of the money has not left Ethereum. At our Monday snapshot, 72% of it sat in addresses we tie to the thief.
The ETH is in a few big piles. At the snapshot, three wallets held 22,785 ETH, three quarters of the thief's ETH. Until Monday afternoon, two of them had never sent anything. One wallet alone holds 4.14M DAI.
The piles have started to move. Just before our snapshot, one of those two wallets sent a small test payment to a new address. Six minutes later it sent 1,956 ETH to the same address. Another big wallet moved 900 ETH to an address the thief already used. Both moves stayed inside the thief's own wallets. At 14:22 UTC, the thief still held $77.8M.
The thief's addresses are already getting fake look-alike transfers from spammers, a trick known as address poisoning. Anyone can follow the stashes with the Bitquery MCP.
08 · The exitsHow money left the thief's hands
About $30.5M has left so far, net of anything that came back.
The biggest single exit is a KuCoin deposit address that took $8.12M and swept it into KuCoin's own wallet. The same address took money from about 175 other senders in a little over a day, and TRM's graph tags part of the flow as Kyrrex. So it is likely Kyrrex's pooled account at KuCoin. Some of the victim's own payments to Kyrrex in October ended up at the same KuCoin address.
LI.FI, a bridge and swap router, took $4.34M. Part of that went through one-time order wallets that TRM tags as Wagyu, a service that swaps crypto into Monero. The amounts match TRM's graph to the unit, but the Monero side is out of sight by design.
FixedFloat, an instant exchange that needs no account, took $1.32M. WellWallet took $250k. Smaller sums went to five more bridges. Another $12.91M went to addresses with no label. Several of those swap and pay out like over-the-counter desks. We saw the same pattern in the $110M TRON laundering circuit.
09 · FreezeWhat can still be frozen
Most of what the thief holds cannot be frozen by an issuer. ETH has no issuer, and DAI has no freeze function.
On Monday, 3.74M USDC still sat in the thief's wallets, nearly all of it in five of them, and Circle can freeze it. KuCoin and Kyrrex can say whose account the deposit address credited. FixedFloat and WellWallet can see who placed the orders they filled.
A 0.13 ETH payout from WellWallet gave the swap wallet its first ETH for network fees, so WellWallet can also see who ordered that payout. One wallet that moved $4.75 million into the thief's addresses is older than the rest. It has made small payments since December 2025, among them one in May to a Revolut deposit address. Revolut can tell who owns that address. The older wallet may belong to a helper rather than the thief. Our investigation team can take a case like this further.
10 · The claimsChecking the claims
Most of the first report holds up on the chain.
| Topic | Claim | What the chain shows | Verdict |
|---|---|---|---|
| Amount | An EU entity is suspected of losing more than $106M from several exchange accounts on 1 November | $108.80M in USDC left Kraken, Crypto.com and OKX for 15 wallets on 1 and 2 November | Supported |
| Coins | The money was withdrawn as USDC and USDT | Every withdrawal we found, on Ethereum from the three exchanges' main wallets, was USDC. The thief later swapped some of it into USDT | USDC only on Ethereum |
| Addresses | These 11 addresses are the theft addresses | Four more addresses took $28.00M. Eight of the 11 listed had been paid by these exchanges before | Incomplete |
| Swap to ETH | The thief swapped USDC for ETH | $62.98M of stablecoins became 27,553 ETH through UniswapX in about four hours | Confirmed |
| Instant exchanges | Funds went through instant exchanges such as WellWallet and Kyrrex | WellWallet took $250,000. The flow tagged Kyrrex ends at a KuCoin deposit address that took $8.12M, likely Kyrrex's pooled account | Partly confirmed |
| Monero | Some funds became Monero through Wagyu | 2,642,400 USDC and 355.53 ETH went through 20 one-time order wallets into LI.FI, the same amounts TRM shows | Matches |
| Bridges | The thief bridged to several chains | $7.10M went, net, to six bridges and swap routers | Confirmed |
11 · LessonsWhat this means for your exchange account
An allowlist protects you only as well as the wallets on it. If the same laptop or phone holds your exchange login and your wallet keys, one break-in can open both.
Keep big balances behind a hardware key, both for logging in and for the wallets on your allowlist. Turn on the waiting period that many exchanges offer for new addresses, so that nobody can add a wallet and cash out to it in the same hour. Watch your allowlisted wallets as closely as the account itself. Payments into a wallet you no longer use are a warning sign.
12 · GapsWhat we could not see
We do not know how the thief got in. We read Ethereum only and checked the three exchanges' main wallets, so other chains, and other wallets at those same exchanges, could still add to the total.
Two of the 15, 0xd3c1…a7c1 and 0x3e6c…40f2, link to the thief through a few steps rather than directly. On Monday morning, $400k from the first reached a thief wallet through two middle wallets. From the second, $3M went through the older wallet that once paid Revolut, then on to the thief. Without these two, the count would be $95.71M.
13 · The methodHow we traced the money
We started from the 11 posted addresses and the exchange wallets that paid them. Then we followed every large payment forward, skipping known services, and looked back for other addresses the same exchange wallets had paid. We checked each wallet's history and each balance at the same moment, so the money in and the money out add up.
We traced the Name.com DNS hijack and the b14g drain the same way last week. You can get the full history of the chain as files on the Bitquery Data Store, in the Ethereum dataset.
We read Ethereum only. Transfers and balances were both read at block 26,327,492, 13:47 UTC on 2 November. Later moves are not covered, apart from the stash moves to 14:22 UTC described in the text.
The total counts USDC that the main wallets of Kraken, Crypto.com and OKX paid to 15 addresses on 1 and 2 November. Other wallets at those exchanges, other exchanges and other chains were not searched.
Two of the 15 addresses link to the thief through a few steps rather than directly. Without them the total would be $95.71M.
A wallet counts as the thief's when most of what it received came from the theft. Contracts, busy services and 26 addresses with long histories count as outside parties. One older wallet that acted as a hub is counted in.
Held ETH is valued at $2,281, the price at the snapshot. Exits are net of money that came back to the thief from the same place, directly or through up to three wallets.
That 11 of the paid addresses belonged to the victim is our reading of their history. It is not confirmed by the victim or the exchanges.
Names of exchanges, bridges and services come from our address labels and from TRM's published graph, checked against on-chain behaviour.
14 · The recordThe addresses behind the theft
Watch the thief's wallets in plain English
Every transfer in this story comes from Bitquery's Ethereum data. The Bitquery MCP server puts that data behind an AI assistant, so you can ask where a wallet's money went, or which wallets an address has paid, without writing a query. The full history is also sold as files on the Bitquery Data Store, in the Ethereum dataset.
This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, or investment advice, and nothing in it is a recommendation to buy, sell or hold any token or asset, or to use or avoid any exchange, wallet, protocol or service.
The findings describe transactions and balances observed on Ethereum on 1 and 2 November 2026. Attributions come from on-chain behaviour; they may be incomplete or incorrect and may be revised as more data becomes available.
References to Kraken, Crypto.com, OKX, KuCoin, Kyrrex, Circle, Tether, Trust Wallet, Uniswap, LI.FI, Wagyu, FixedFloat, WellWallet, Bridgers, Rango, Chainflip, Harbor, MetaMask, Revolut, ZachXBT, TRM or any other named project, company or person describe what the public record shows and what those parties have said in public. They are not statements about any party's intent, security practices, solvency or conduct, and nothing here asserts that any named party acted unlawfully or negligently. The victim is not named. The wallets that took the funds are described by their behaviour and attributed to nobody.
Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from reliance on this material. All trademarks and company names are the property of their respective owners.
Reported by Gaurav Agarwal for Bitquery Research, with AI tools; every figure was checked against the raw data.
FAQ
Was Kraken hacked?
Nothing shows that. The withdrawals came from one customer's accounts, and most of the money went to addresses those exchanges had paid before. The pattern fits a break-in on the customer's side.
How much was stolen?
We traced $108.80M in USDC taken from accounts at Kraken, Crypto.com and OKX on 1 and 2 November. The first report, citing ZachXBT, put the suspected loss at more than $106 million.
Where did the money go?
Most of it was swapped into ETH and still sat on Ethereum on 2 November. About $30.5M had left through a KuCoin deposit address, bridges and instant exchanges, with one route into Monero.
Can the money be frozen or recovered?
Only a small part can be frozen by an issuer. About $3.7M was still in USDC, which Circle can freeze. Exchanges and swap services that received funds can hold accounts or share records with police.
Who is the victim?
The victim has not been named. ZachXBT described it as an EU entity. The wallets' history points to an owner that has used Kraken since May, most likely a business.
What is a withdrawal allowlist?
It is a setting that lets an account send crypto only to addresses you approved in advance. It blocks a thief who has your password, unless the thief also controls those addresses or can add new ones.
Run the next investigation in minutes
Ask any question of the blockchain. Bitquery's AI Investigations agent traces funds, attributes wallets, and writes auditable reports across every major chain. Prefer to do it yourself? Connect the Bitquery MCP server to your AI assistant, pull the raw datasets, or query the chain directly with the Bitquery API.