- Bitquery traced $108.8 million in stolen USDC across Kraken, Crypto.com, and OKX.
- The attacker swapped $62.98 million worth of stablecoins for 27,553 ETH.
- The breach highlights how compromised wallets can bypass exchange withdrawal allowlists.
A crypto theft involving a European financial institution has highlighted the limitations of exchange withdrawal allowlists after an attacker gained access to both exchange accounts and previously approved wallets.
Blockchain investigator ZachXBT initially reported more than $106 million stolen but later identified an additional $27 million. This pushed the loss to more than $133 million. He suggested that a Western European financial institution may have been compromised and criticized the lack of a formal incident disclosure.
Bitquery Traces $108.8 Million Across Three Exchanges
Blockchain analytics firm Bitquery traced $108.8 million in USDC withdrawals from Kraken, Crypto.com, and OKX between November 1 and 2.
The funds were distributed across 15 wallet addresses over approximately 21 hours. Eleven had previously received payments from the same exchanges, suggesting the attacker may have accessed wallets the victim had already used.
Bitquery found that eight of the 11 wallets had been active before the incident, with some dating back to May 2026. This raises the possibility that the attacker obtained private keys in addition to exchange credentials through a compromised device, wallet infrastructure, or insider access.
Millions Converted Into Ethereum
Meanwhile, the attacker quickly moved the withdrawn funds through fresh wallets, with a median transfer time of approximately three minutes. One wallet received 43 Kraken withdrawals within 91 minutes, each below $50,000.
The attacker subsequently converted approximately $62.98 million in stablecoins into 27,553 ETH through UniswapX. The attacker converted other funds into DAI or moved them through bridges and exchanges.
Bitquery also traced $8.12 million to a KuCoin deposit address and $4.34 million through the LI.FI bridge, alongside transactions involving services associated with Monero conversions.
At 13:47 UTC on November 2, $78.27 million remained in linked Ethereum wallets, including $68.9 million in ETH, $5.6 million in DAI, and $3.7 million in USDC.
Only the USDC balance was directly subject to an issuer freeze, as ETH cannot be frozen by an issuer and DAI has no freeze function.
Follow us on X for real-time crypto updates.
Why Withdrawal Allowlists May Not Be Enough
Withdrawal allowlists restrict transfers to pre-approved wallet addresses, helping prevent attackers with stolen exchange credentials from sending funds to unfamiliar destinations. However, this protection becomes ineffective if attackers also control the approved wallets or their private keys.
The incident highlights the risks of storing exchange credentials and wallet keys on the same compromised device.
Bitquery recommends separating exchange access from wallet keys, using hardware security keys, enabling withdrawal delays where available, and monitoring previously approved wallets for suspicious activity. These measures reduce the risk of a single compromised device exposing multiple layers of protection.
Questions Over Incident Disclosure
ZachXBT also criticized the response to the theft, arguing that the lack of proper disclosure allowed more than $30 million to be laundered without being frozen by EU law enforcement.
The victim’s identity remains undisclosed. Bitquery noted that its investigation covered Ethereum transactions involving the main wallets of Kraken, Crypto.com, and OKX, meaning the total could be higher if other wallets or blockchain networks were involved.
Ultimately, the incident demonstrates that withdrawal allowlists alone cannot adequately protect large cryptocurrency holdings when attackers gain access to both exchange accounts and the wallets authorized to receive funds.
Subscribe to our YouTube channel for the latest crypto news.
Related: Your Crypto Wallet Could Be a Target: AI-Powered Malware Is on the Rise
Please note, this site provides content for entertainment purposes only and does not offer financial advice. Read more here