Stolen funds were reportedly moved from stablecoins into ETH, then into Monero, before being sent through cross-chain bridges
An entity based in the European Union may have lost over $106 million in a theft that hit multiple accounts it held on centralized exchanges.
The victim has not been named, and neither has the method of compromise. What has surfaced is the path the money took afterward, and it was a busy itinerary.
On-chain investigator ZachXBT brought the incident to public attention. His tracing shows funds leaving the exchange accounts, changing form several times, and ending up in some of the hardest places in crypto to follow.
How the funds moved
The attacker mainly withdrew the funds as USDC and USDT. Both are stablecoins, tokens designed to hold a steady value pegged to the US dollar.
The stablecoins did not stay stablecoins for long. The attacker swapped them into Ethereum’s native token, ETH, and did it quickly.
From there, funds passed through instant exchange services, including Kyrrex and WellWallet. These are platforms built for fast swaps between assets, and here they served as waypoints on the trip.
The next stop was Monero, ticker XMR, with the research pointing to Wagyu as the venue for that conversion. Monero is a privacy-focused crypto that hides transaction details that most public blockchains leave on display.
After the Monero conversion, the funds were sent through cross-chain bridges. Bridges are tools that move value from one blockchain to another.
Eleven addresses tied to the incident have been publicly identified. That gives investigators and exchanges a concrete list to monitor, even if the trail gets murky past the Monero step.
What is still unknown
The identity of the victim has not been disclosed. All that is known publicly is that the entity is based in the EU.
The method of compromise also remains undisclosed. Losses spread across several exchange accounts raise obvious questions about how an attacker reached all of them, but no explanation has been made public.
What this means
The most immediate stakes belong to recovery efforts, and the odds there look tough. The research describes the conversion to Monero and the bridge routing as making recovery complex and challenging for investigators.
The stablecoin and ETH legs of the journey happened on public ledgers, which is why researchers like ZachXBT can reconstruct them. The Monero leg is the point where that kind of public tracing becomes far harder, and that is likely why the attacker went there.
The instant exchange services named in the tracing may also face questions. Kyrrex and WellWallet appear as stops on the route, and how such services handle large, fast-moving inflows from flagged sources is likely to draw attention from investigators.
For now, there are a few things worth tracking. The first is whether the victim is identified, and whether they explain how the accounts were breached.
The second is activity on the eleven publicly identified addresses. Any further movement could give investigators fresh leads before more funds slip into harder-to-trace channels.
The third is how the exchanges and swap services involved respond. A theft of this size that ends in a privacy coin tends to be resolved, if at all, by the platforms that touched the money along the way.
