USDC and USDT stolen, ETH swapped, XMR obscured: Inside a $106M EU hack

In an unexpected turn of events, a suspected theft of more than $106 million from a European Union [EU]-based entity has raised a fresh wave of concern in the crypto community.

According to pseudonymous blockchain investigator ZachXBT, on the 1st of November, an unidentified attacker drained funds from accounts held across multiple centralized cryptocurrency exchanges.

The suspected stolen assets included Circle [USDC] and Tether [USDT]. 

Laundering was also part of the game plan

Following the suspected theft, the attacker reportedly began moving the funds through a series of transactions to make them harder to trace and potentially recover.

To begin with, the illicit actor initially swapped the stolen USDC and USDT into Ethereum [ETH]. The attacker then transferred the ETH to instant cryptocurrency exchanges, including WellWallet and Kyrrex. 

Going forward, the wrongdoer converted ETH into Monero [XMR], a privacy-focused cryptocurrency. Since the latter uses privacy-enhancing technologies to conceal transaction details, including the sender, recipient, and transaction amount, tracing has become even more difficult. 

Not only this, but the suspected hacker also reportedly bridged assets across multiple blockchain networks, adding another layer of complexity to the ongoing investigation.

The unexpected plot twist

However, ZachXBT offered an important revelation regarding the identity of the suspected attacker. Despite the scale of the incident and the laundering techniques involved, the investigator stated,

While the illicit actor remains unidentified, I can say with a high degree of confidence it is NOT Lazarus Group based on multiple laundering indicators.

However, the EU entity has not yet publicly confirmed the suspected theft, adding more suspicion to the aforementioned attack. 

The EU’s MiCA rules are at work

This comes on the heels of the European Banking Authority (EBA) recognizing USDC as the EU’s first major e-money token under MiCA.

At the same time, the European Securities and Markets Authority (ESMA) has directed national regulators to restrict services involving non-MiCA-compliant stablecoins to sell-only, conversion, transfer, and withdrawal functions, with continued services subject to strict supervision.

Final Summary

• The suspected stolen assets included USDC and USDT.
• ZachXBT confirmed that North Korea’s Lazarus Group was in no way connected to the operation.