Suspected crypto theft in the EU: Kraken and Crypto.com freeze funds after $133 million outflow

More than $133 million in crypto has allegedly flowed out of an as yet unnamed entity in the European Union. That is the finding of blockchain investigator ZachXBT, and the exchanges Kraken and Crypto.com have since restricted accounts and blocked funds connected to the incident. Who the victim is remains unclear. So far neither an authority nor a company has confirmed that an attack took place at all. According to the exchanges named, their customers face no risk. This article sets out what is established, what remains speculation and how you can secure your own exchange account against the usual follow-up attacks.

Crypto theft in the EU: ZachXBT traces $133 million

ZachXBT is a pseudonymous on-chain investigator who has spent years publicly tracing money flows after hacks and frauds. On-chain analysis means reading the publicly visible transactions on a blockchain and linking addresses, amounts and timestamps into a picture. On Monday, November 2, 2026, he flagged suspicious outflows of about $106 million, according to Cointelegraph. The source, he said, was an entity in the European Union that he did not name.

On Tuesday he followed up. He found further withdrawals from centralised exchanges worth about $27 million, part of which left only after his first report. That puts the alleged loss at roughly $133 million. The public does not know the victim's name: ZachXBT does not disclose it, and the exchanges involved are also silent on the point.

From $106 million to $133 million: how the total grew

ZachXBT gives the total and follows the wallets linked to the funds. The analytics firm Bitquery has recalculated the movements on these addresses:

• $62.98 million in stablecoins was swapped into 27,553 ether within about four hours.
• On Monday afternoon, according to Bitquery, about $78.3 million still sat in wallets attributed to the alleged attacker.
• About $30.5 million had already been moved out of the observed addresses by then.

The total is therefore growing because investigators are finding further outflows from the same source, and not because new victims are emerging. The figures are as of early afternoon on Tuesday, November 3, 2026. New findings may change the number again.

Kraken, Crypto.com and OKX: the exchanges on the trail

According to Bitquery, the stolen funds were withdrawn via accounts at Kraken, Crypto.com and OKX. All three exchanges also serve customers in Germany, so the question of whether retail customers were affected came up quickly. The exchanges' statements, as reported by Cointelegraph, suggest they were not:

• Kraken has restricted accounts linked to the theft and is working with law enforcement on recovery. The incident did not originate on the Kraken platform, its security systems were not compromised, no customer account was taken over and there is no ongoing risk to customers, the exchange said.
• Crypto.com says it has blocked funds connected to the incident. The platform is fully operational and user balances are safe.
• OKX acknowledged the press enquiry and said it was looking into the matter.

In practice, the account freezes at Kraken concern accounts tied to the suspected perpetrator or to the flow of funds. An ordinary customer account is not restricted as a result. We described how such freezes work technically when covering the dust attack on Kraken in August.

Stablecoins frozen: why Circle and Tether could stop only $4.84 million

Stablecoins are tokens whose value is pegged to a government currency, usually the US dollar. The large issuers Circle (USDC) and Tether (USDT) can block individual addresses and freeze the tokens held there. After hacks this is often the quickest lever for holding on to the loot. In this case it barely worked: according to Cointelegraph, Circle was able to freeze only about $3.74 million in USDC, while Tether had blocked $1.1 million in USDT. Together that is about $4.84 million, or less than 4 percent of the alleged total.

The reason is speed. Anyone who swaps stablecoins into ether within hours puts them beyond the issuer's reach. Ether itself cannot be frozen centrally by anyone. Attackers exploit this gap regularly, and it shows why exchanges and issuers depend on fast tip-offs after an incident.

Laundering via ether and Monero: the path of the funds according to ZachXBT

After the swap into ether, the funds are said to have moved on. ZachXBT describes how the suspected perpetrator switched into ether and Monero via instant swap services and bridges between blockchains. A bridge is a service that transfers value from one blockchain to another. Monero is a cryptocurrency in which the sender, recipient and amount of a transaction are obscured. Moving funds there makes the trail much harder for investigators to read.

Another assessment by the investigator stands out: in his view, the patterns do not match those of North Korea's Lazarus Group. The case would therefore stand on its own and would not be a further part of the wave of attacks surrounding the Binance hack of October 29. Exactly who is behind the new case is unclear. You can find an overview of the attacks of recent days in our situation report crypto hack news.

Cover-up allegation against an unnamed institution: no evidence so far

The most pointed part of the report is a supposition. According to Cointelegraph, ZachXBT's working hypothesis is that a large financial institution in Western Europe was attacked and that the incident is currently being covered up. Because the incident was not properly disclosed, more than $30 million could be laundered, he argues. European law enforcement might otherwise have been able to freeze the funds.

These statements are the investigator's assessment, not established fact. No institution has been named, and there is no statement from an EU authority or a victim. ZachXBT has not yet publicly presented solid evidence of an attack on a financial institution or of a cover-up, and the identity of the victim is unconfirmed. The line can therefore be drawn cleanly: the outflows on the blockchain can be traced and the exchanges' account freezes are confirmed, while the reading as a theft from a financial institution and the cover-up allegation remain open.

Reporting duty under DORA: financial institutions must report serious IT incidents to supervisors

The disclosure question has a legal background. Since January 17, 2025 the EU has applied the Digital Operational Resilience Act, or DORA (Regulation (EU) 2022/2554). DORA is a regulation that obliges banks, insurers, investment firms and also crypto service providers licensed under MiCA to meet minimum standards for IT security. This includes reporting major ICT incidents to the competent supervisor, which in Germany is usually BaFin.

The limit of this obligation matters: reports go to the supervisor, not to the public. Whether an affected institution has reported its incident cannot be verified from the outside. The fact that nothing is publicly known therefore proves neither a cover-up nor the opposite. Financial firms must inform customers mainly when their financial interests are affected.

How to protect yourself from phishing and account takeover after an exchange incident

What happened: Between November 1 and 3, 2026, more than $133 million allegedly flowed out of accounts belonging to an unnamed entity in the EU, according to ZachXBT and Bitquery, including via Kraken, Crypto.com and OKX. The funds were quickly swapped into ether and Monero; about $4.84 million has been frozen so far (as of November 3, 2026, source Cointelegraph).

Are you affected? According to Kraken and Crypto.com, no customer account was taken over and the platforms are running normally. If you hold an ordinary account at one of the three exchanges, you are not affected on current information. The risk for retail investors lies elsewhere: big headlines attract fraudsters who send emails, texts or calls in the exchanges' name and demand supposed security checks.

1. Official channel: Open messages about this case only in the app or via your exchange's address typed in by hand, never through a link in an email or text.
2. App-based two-factor: Switch logins and withdrawals to an authenticator app or a security key, since SMS codes can be intercepted via someone else's SIM card.
3. Withdrawal whitelist: Turn on the address list for withdrawals if your exchange offers one, so crypto withdrawals go only to addresses you have approved in advance.
4. Check API keys: Delete API keys you created for trading bots or tax tools and no longer use, and remove withdrawal rights from the rest.
5. No recovery services: Ignore offers to recover lost or frozen crypto for a fee, and never hand over your recovery phrase; no exchange asks for it.

Our guide how to store crypto safely explains the basics of secure custody, and the hardware wallet comparison compares suitable devices.

Hot wallet and exchange account: where crypto sits during an incident

The case shows once again how fast crypto can be moved as soon as someone has access to an account. On an exchange account, the exchange holds your coins in its own wallets. Part of them sits in so-called hot wallets, which are connected to the internet and ready for fast withdrawals. With reputable providers the larger part is kept offline in cold wallets. What matters most for you is whether your provider is supervised and how it segregates client funds.

In the EU this has been governed since the end of 2024 by the MiCA regulation. Crypto service providers licensed under MiCA must hold client assets separately from their own and are subject to supervision. Our comparison of regulated crypto exchanges shows which exchanges hold this licence. If you hold coins for longer and do not trade, you are better off moving them to your own wallet whose keys only you control. With a hardware wallet, the private key stays on a device that is never directly connected to the internet.

Client funds at Kraken and Crypto.com: the platforms report normal operations

On current information, the incident changes little in the day-to-day life of German investors. Kraken and Crypto.com report normal operations, and deposits and withdrawals are working. The frozen accounts are part of the investigation and not a sign of a disruption. The case was different at the Brazilian exchange Mercado Bitcoin, which halted all withdrawals on November 2 after an attack; the details are in our report Mercado Bitcoin halts withdrawals.

Three points remain open and should become clearer in the coming days: who the victim is, whether a supervisor confirms the case and whether further funds are frozen. As long as there is no statement from a victim or an authority, the reading as a theft from a Western European financial institution remains a supposition.

EU crypto theft: only $4.84 million of $133 million is frozen

From everything known, the alleged theft does not directly affect retail customers. It is still a reason to review your own setup, because the follow-up phishing attacks target exactly them. Three steps help:

1. Check whether your exchange holds a MiCA licence and keeps client funds segregated. The comparison of regulated crypto exchanges gives an overview.
2. Move holdings you do not actively trade to your own hardware wallet. The hardware wallet comparison shows which devices are suitable.
3. Use a separate app wallet with a small amount for DeFi and experiments. You can find suitable apps in the software wallet comparison.

(As of November 3, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)