Cracking blocks accounts after possible $133 million crypto theft

Crypto exchange Kraken has blocked multiple accounts that may be involved in a major crypto theft in Europe. According to blockchain researcher ZachXBT, more than 133 million dollars worth of crypto coins have disappeared from a still unknown European organisation.

Some of the money has now been exchanged and moved further, making it increasingly difficult to recover the loot.

Blockchain researcher ZachXBT reported a suspected theft of 106 million dollars on Monday. On Tuesday, he discovered another $27 million in suspicious recordings, bringing the estimated total to more than $133 million.

It is striking that some recordings according to the investigator even took place after he had already made the possible theft public.

Research by blockchain analytics firm Bitquery shows that large amounts were withdrawn through accounts at Kraken, Crypto.com and OKX.

Kraken now confirms that it has blocked several accounts involved. The crypto exchange is working with investigative services to recover as much money as possible.

According to Kraken, their own systems have not been hacked and no customer accounts have been taken over. The incident would therefore have occurred outside the trading platform.

Crypto.com has also taken measures to prevent suspicious funds from being moved further via the platform. OKX examines the reports.

Exactly how the attacker gained access to the money is not yet clear. Investigators suspect that someone has gained access to existing accounts or their associated security credentials.

Meanwhile, the suspected attacker tries to move the stolen crypto coins further.

According to Bitquery, within about four hours, nearly $63 million worth of stablecoins were exchanged for 27,553 Ethereum (ETH).

This makes it more difficult to recover the funds. Issuers of certain stablecoins can freeze suspicious funds, but with Ethereum that possibility does not exist in the same way.

Monday afternoon, there was still about $78.3 million in wallets linked to the attacker. More than 30 million dollars had already been moved further.

Of the remaining amount, only $3.74 million was in USDC, a stablecoin whose issuer Circle could possibly freeze the funds.

Tether had also already blocked about $1.1 million of USDT.

The amounts are snapshots. Because the wallets involved can be used continuously, the distribution may have changed in the meantime.

The identity of the victim is still unknown. ZachXBT suspects that it is a large financial institution in Western Europe. According to him, it is possible that the organization deliberately stops the attack.

However, there is still no independent evidence for that accusation. Also, no institution has publicly confirmed that it has lost more than $133 million in crypto coins.

The investigator states that the absence of an official report has given the attacker extra time to channel money. According to him, some of the funds might have been frozen sooner.

The identity of the attacker is also still unclear.

ZachXBT doesn't think North Korean hacker group Lazarus is behind the attack. According to him, the way in which the crypto coins are moved differs from the known working method of this group.

For the time being, the research focuses mainly on tracking the disappeared crypto coins and finding out the organization that may have been affected.