Update (Nov. 4, 2026, 8:20 am UTC): This article has been up to date to incorporate feedback from Kyrrex.
Update (Nov. 3, 2026, 8:08 pm UTC): The headline has been clarified to specify that Kraken’s account restrictions relate to accounts linked to the suspected theft. Kraken says its programs and buyer accounts weren’t compromised.
Update (Nov. 3, 2026, 11:51 am UTC): This article has been up to date with a revised headline and responses from Kraken, OKX and Crypto.com.
Kraken has restricted accounts linked to a suspected crypto theft of greater than $133 million from an unidentified European Union entity and is working with regulation enforcement to help restoration efforts.
“This incident did not originate on the Kraken platform, and we’re actively investigating reports that some of the assets were subsequently moved through accounts on our platform,” Kraken informed Cointelegraph. “We’ve restricted the accounts in question and are working with law enforcement to support recovery efforts.”
Kraken’s assertion follows blockchain investigator ZachXBT’s disclosure on Tuesday that he recognized one other $27 million in withdrawals from centralized exchanges, rising the suspected losses from the $106 million he reported on Monday. He stated some withdrawals occurred after his preliminary disclosure.
Bitquery reported that the suspected stolen funds had been withdrawn from accounts at Kraken, Crypto.com and OKX. It additionally discovered that $62.98 million in stablecoins was transformed into 27,553 Ether (ETH) inside roughly 4 hours.
Kraken stated its safety programs had not been compromised, no buyer accounts had been taken over and there was no ongoing danger to its prospects.
Crypto.com informed Cointelegraph that it had taken steps to forestall funds related to the incident from transferring via its platform.
“We are aware of this report and have taken appropriate action to block any funds associated with this third-party incident from moving through Crypto.com,” a spokesperson stated. “Our platform remains fully operational, and all user funds are secure and accessible.”
OKX acknowledged Cointelegraph’s request for remark and stated it was wanting into the matter.
As of 13:47 UTC Monday, roughly $78.3 million remained in wallets linked to the suspected attacker, whereas $30.5 million had moved out of the tracked addresses, based on Bitquery. Only $3.74 million remained in USDC that issuer Circle may probably freeze, whereas Tether had already frozen $1.1 million in USDT.
Bitquery additionally traced related transactions to an account at Kyrrex, citing labels from blockchain analytics agency TRM Labs.
Kyrrex informed Cointelegraph that it was conscious of reviews in regards to the alleged motion of stolen funds and was carefully monitoring the scenario.
“While we cannot comment on individual transactions, specific wallet addresses or any related internal reviews, Kyrrex stands ready to cooperate with competent law enforcement and regulatory authorities,” the corporate stated.
Victim’s identification stays unverified
“My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up,” ZachXBT stated on his Telegram channel.
He additionally stated the dearth of a correct incident disclosure allowed greater than $30 million to be laundered, claiming EU regulation enforcement may in any other case have frozen the funds. The sufferer’s identification and allegations of a cover-up stay unverified.
ZachXBT stated earlier that the attacker was swapping funds into ETH and Monero (XMR) via immediate exchanges and cross-chain bridges. He stated the laundering patterns didn’t match these usually utilized by North Korea’s Lazarus Group.
Related: North Korea denies position in $6.3B Binance hack, factors finger at US
Content Source: cointelegraph.com
