$133M Just Walked Out Through Kraken, Crypto.com and OKX. Nobody Has Admitted Being Robbed, and ZachXBT Thinks a European Institution Is Covering It Up

More than $133 million has moved through three of the biggest exchanges in crypto, and nobody has said it was theirs.

On-chain investigator ZachXBT says the money was stolen. The exchanges it moved through say they’re restricting accounts and blocking funds. No bank, broker or fintech has announced a breach, and neither has any regulator.

ZachXBT has a theory about the silence:

“My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up.”

That’s a theory, not a confirmed fact. But the lack of a victim is the strangest part of a nine-figure theft in a week already full of them.

---

What Happened

Here’s what’s been reported, mostly via Cointelegraph, which cites ZachXBT and the analytics firm Bitquery:

• Starting around Sunday, November 1: large withdrawals hit accounts at Kraken, Crypto.com and OKX, according to Bitquery.
• Monday, November 2: ZachXBT flags roughly $106 million in suspected stolen outflows on his Telegram channel.
• Within about four hours, Bitquery says, $62.98 million in stablecoins was converted into 27,553 ETH.
• As of 13:47 UTC Monday, Bitquery had about $78.3 million still sitting in wallets linked to the attacker and $30.5 million already moved out of the addresses it was tracking.
• Tuesday, November 3: ZachXBT reports about $27 million more in withdrawals, bringing the total to around $133 million. Some of those withdrawals, he said, happened after his first public alert.

Read that last line again. The theft was public and still going.

According to Cointelegraph, the funds went from ETH into Monero through instant exchanges and cross-chain bridges. Once it’s in XMR, tracing gets very hard.

---

What the Exchanges Say

Kraken said the theft didn’t start with Kraken:

“This incident did not originate on the Kraken platform … we’re actively investigating reports that some of the assets were subsequently moved through accounts on our platform. We’ve restricted the accounts in question and are working with law enforcement to support recovery efforts.”

Kraken also said its security systems weren’t compromised and no customer accounts were taken over.

Crypto.com:

“We are aware of this report and have taken appropriate action to block any funds associated with this third-party incident from moving through Crypto.com. Our platform remains fully operational, and all user funds are secure and accessible.”

OKX told Cointelegraph it was looking into the matter. It didn’t give a further statement.

The phrase that matters is “third-party incident.” Nobody is saying the exchanges were hacked. The money came from somewhere else, someone with access to those exchange accounts withdrew it, and the victim behind those accounts hasn’t spoken.

---

How Much Got Frozen? Very Little

Per Cointelegraph’s reporting:

• Tether has frozen $1.1 million in USDT.
• Circle could potentially freeze about $3.74 million in USDC. At the time of reporting, that was a possibility, not a confirmed freeze.

That’s single-digit millions out of $133 million. Most of the stablecoin balance was swapped into ETH within hours, which put it out of reach of the issuers’ freeze powers.

ZachXBT’s argument is that this is why the silence matters. According to Cointelegraph, he said the lack of a proper disclosure let more than $30 million get laundered, money EU law enforcement might otherwise have frozen.

---

Not North Korea (Probably)

After a week of Binance-hack coverage, everyone’s first guess is TraderTraitor. ZachXBT doesn’t think so. Cointelegraph reports that he said the laundering patterns “did not match those typically used by North Korea’s Lazarus Group.”

So we have a nine-figure theft with no named victim, no named attacker, and laundering that doesn’t look like the usual suspects.

To be clear about what’s still unconfirmed: the victim’s identity, whether there’s a cover-up, and the final total are all unverified. Cointelegraph itself says “the victim’s identity and allegations of a cover-up remain unverified.” Every dollar figure comes from on-chain analysis by ZachXBT and Bitquery. No company or authority has confirmed the theft.

---

Why This Matters for Crypto Jobs

1. Exchange compliance teams are now the front line, in real time. Kraken and Crypto.com acted on a Telegram post and a blockchain analytics report, not on a request from the victim. Someone had to see the alert, match addresses to internal accounts and lock them down while the money was moving. Investigations, financial-crime and transaction-monitoring analysts are the people who do that, and those desks are hiring.

2. The incident-response gap is a TradFi problem now. If ZachXBT is right and a traditional European institution lost crypto and stayed quiet, that shows a lack of people who know how to run a crypto incident: who to call at Tether and Circle, how fast to publish addresses, and how to work with exchanges before the funds reach Monero. Banks and brokers moving into digital assets under MiCA need that playbook, and they need people who’ve run one.

3. Freeze speed is a skill. About $1.1M was frozen and $62.98M was swapped out of stablecoins in roughly four hours. That gap between detection and action is what on-chain monitoring, threat-intel and stablecoin-issuer compliance roles are paid to close.

4. Independent investigators are setting the agenda. In the Mercado Bitcoin breach and now this one, the first public numbers came from people outside the victim organization. Analytics firms like Bitquery, Chainalysis, Elliptic and TRM keep growing their investigations teams, and they’re hiring.

---

The Bottom Line

$133 million left through Kraken, Crypto.com and OKX. Some of it moved after the theft was already public. Most of it was converted to ETH and then Monero before anyone could freeze it. The exchanges have answered questions. The alleged victim hasn’t.

Maybe the institution is quietly working with police. Maybe ZachXBT’s theory is wrong. But in crypto, staying quiet doesn’t hide a theft from people watching the chain. It gives the attacker more time.

---

Want to be the one who locks the accounts before the Monero swap? Exchanges, analytics firms and banks entering crypto are hiring for compliance, investigations and on-chain security. Browse open roles on Cryptogrind →