Kraken and Crypto.com swiftly respond to major crypto theft by freezing suspect funds to enhance security.
A suspected theft of more than $133 million in crypto has prompted Kraken to restrict accounts connected to the incident, while investigators track the stolen assets as they move through exchanges, conversion services and cross-chain bridges.
Blockchain investigator ZachXBT first flagged the incident on Monday, saying an unidentified European entity had allegedly lost more than $106 million through withdrawals from several centralized exchange accounts on Nov. 1.
The suspected attacker withdrew the assets in USDC and USDT before swapping stablecoins for ETH, routing transactions through instant exchanges including WellWallet and Kyrrex, converting funds into Monero through Wagyu and transferring assets across multiple blockchains using bridges.
According to blockchain analytics firm Bitquery, the withdrawals involved accounts at Kraken, Crypto.com and OKX. Its analysis showed that approximately $63 million in stablecoins was exchanged for 27,553 ETH over approximately four hours.
Bitquery’s tracking showed that a large portion of the suspected stolen funds had already moved out of identified wallets, leaving only a limited amount of stablecoins potentially available for freezing by Monday evening. Tether had frozen some of the associated USDT, while Circle retained the ability to freeze a smaller portion of the remaining USDC.
The estimated amount stolen climbed above $133 million after ZachXBT uncovered an additional $27 million in exchange withdrawals on Tuesday.
Kraken said it had restricted the relevant accounts after learning that some assets linked to the theft had reportedly passed through its platform, Cointelegraph reported. The exchange denied any connection between the incident and a breach of its infrastructure, adding that no customer accounts were taken over and customer funds were unaffected.
Crypto.com separately said it had taken measures to prevent associated funds from moving through its platform, while OKX was reviewing the allegations.
Neither the victim nor the attacker has been identified. ZachXBT suggested that the targeted entity could be a major Western European financial institution and raised concerns about an alleged lack of public disclosure.
Based on the movement of funds and other transaction indicators, he also said he was highly confident the attacker was not North Korea’s Lazarus Group.
