$133m drained, 4% frozen: stablecoin freezes are no safety net
About $133m has been withdrawn from exchange accounts of an unidentified organisation in the EU since 1 November; Circle and Tether froze only about $4.8m.
A large crypto theft in Europe shows how quickly thieves swap stablecoins into other coins before issuers can freeze them. Unlike in the Binance case, almost all the loot remains at large.
What happened
On Sunday 1 November more than $106m flowed out of several accounts held by an unnamed EU organisation at centralised crypto exchanges, initially in the stablecoins USDC and USDT. ZachXBT, a well-known on-chain investigator, reported this on 2 November; a day later he found further withdrawals of about $27m, bringing the total to roughly $133m. According to Bitquery data, the thieves swapped $62.98m into 27,553 ether within about four hours, and some funds went through instant-swap services into Monero, a hard-to-trace cryptocurrency. Kraken restricted linked accounts and stresses that the incident did not originate on its platform. Crypto.com blocked related funds; OKX is looking into the matter. Circle froze about $3.74m of USDC and Tether $1.1m of USDT, less than 4% in total. In the Binance case Circle froze about 44% of the haul, according to Elliptic. No authority or company has yet confirmed who the victim is; speculation about a cover-up at a financial institution is unsubstantiated.
What follows
For firms holding crypto on exchange accounts, the security question shifts from the coin to account management: without strict limits on API keys, access rights and withdrawal addresses, everything can be lost in minutes. The hope that issuers will reliably freeze stolen stablecoins holds only if thieves are slow. That matters for insurers and auditors who value crypto holdings. Assessment: as long as the victim and the point of entry are unknown, it is unclear whether this was an exchange problem or a customer-side one. ZachXBT judges that North Korea's Lazarus Group is not behind it this time.
What changes in practice
- Firms holding crypto
- Allow-listed withdrawal addresses, limits and separate access rights cap the damage if an account is taken over.
- Crypto exchanges
- They freeze suspicious accounts but are not automatically liable when an attack started on the customer's side.
- Insurers and auditors
- Stablecoin freezes are no reliable protection; what matters is how fast thieves swap.
What to watch
- Whether the victim comes forward or a regulator confirms the case
- Further freezes by exchanges and stablecoin issuers
- New guidance from EU supervisors under MiCA on withdrawal limits and account protection
Sources
- ZachXBT (Telegram): Hinweis auf Abflüsse von EU-Organisation, 2.11.2026
- Decrypt: Mystery $106 Million Crypto Theft Hits EU Entity, 2.11.2026
- CryptoTicker: EU crypto theft: $133m traced, Kraken freezes accounts, 3.11.2026