Cryptocurrency exchange Kraken restricted multiple accounts connected to a suspected crypto theft exceeding $133 million from an unidentified European Union entity, according to an on-chain investigation by Bitquery published on November 3, 2026.
Kraken stated that the breach did not originate within its platform infrastructure. The exchange clarified that its security systems were not compromised, no customer accounts were taken over, and compliance teams are actively collaborating with law enforcement to support asset recovery.
Crypto.com took preventive actions to block illicit capital tied to the third-party security incident from moving through its system. The company confirmed that operations remain fully functional, while OKX acknowledged receipt of formal inquiries and initiated internal review processes.
Multi-million dollar transfers across centralized platforms
Blockchain investigator ZachXBT disclosed on November 3 that he identified another $27 million in withdrawals from centralized exchanges. This adjustment raised the overall suspected losses from the $106 million figure initially reported on November 2.
On-chain records show that initial withdrawals on November 1 drained balances in USDC and USDT across eleven digital wallets. Transactions occurred within tight time frames before platforms could implement protective freezes on compromised accounts.
Several of these secondary withdrawals occurred after the initial public alert was shared. The identified addresses continued receiving assets associated with the victim’s accounts, showing persistent fund dispersal through multiple trading venues.
Flow analysis showed that the attacker converted $62.98 million in stablecoins into 27,553 Ether within roughly four hours. This rapid asset swap minimized the window for administrative interventions by token issuers across smart contract layers.
Accelerated conversion into assets lacking freeze controls
By the afternoon of November 2, Tether froze 1.1 million USDT held at an identified address. However, that action left the Ether balance at the same address unaffected, while $3.74 million in USDC remained subject to potential freezes by Circle.
The attacker routed additional funds into Monero through decentralized swap platforms and cross-chain bridges. This multi-hop laundering pattern was designed to obscure blockchain traces before European authorities could execute coordinated asset seizures.
The scale of this event aligns with vulnerabilities seen during the exploits recorded in September, when multiple institutional treasuries and custodial services suffered security compromises across several jurisdictions.
Laundering routes and ongoing institutional tracing
ZachXBT reported that the laundering techniques do not match patterns typically associated with the North Korean Lazarus Group. Concurrently, Bitquery noted that approximately $30.5 million had already transferred out of the initially flagged destination addresses.
This exploit compounds broader market pressure reflecting the losses during the third quarter, where compromised centralized exchange credentials drove significant capital losses across the sector during the preceding three-month period.
The investigator proposed a working theory suggesting an undisclosed Western European financial institution suffered the security exploit. However, allegations regarding an intentional cover-up and the corporate identity of the targeted organization remain unconfirmed by regulators, independent audits, or official corporate disclosures.
Security analysts pointed out that the absence of a swift public disclosure significantly narrowed the operational window for asset recovery. Without early notification, custodial platforms could not deploy automated filters before stolen funds entered non-custodial privacy channels.
As of November 3, 2026, approximately $78.3 million remains situated in monitored addresses under attacker control. European law enforcement agencies continue working with forensics teams and centralized platforms to establish verifiable recovery pathways.
This article is for informational purposes only and does not constitute financial advice.
