.png){kind=logo}
Quick overview
This is some text inside of a div block.
.webp)
On November 1, 2026, an EU entity is reported to have lost more than $106M from several of its accounts at centralized exchanges. The theft was disclosed in a public alert by on-chain investigator ZachXBT on November 2, 2026. The victim has not been named and has not commented. Scorechain makes no attribution of who is behind it.
This is what Scorechain sees on Ethereum. Between 13:09 and 22:44 UTC on November 1, $108.2M in USDC left two exchange hot wallets for 14 Ethereum addresses, one withdrawal each. Within hours, most of it had been consolidated, swapped to ETH through UniswapX, and split across a network of holding wallets. Those wallets are now attributed in Scorechain to the entity EU Entity CEX Accounts Exploiter (11-26), with a critical risk score.
The figures move as the funds move. This post reflects Scorechain data up to the evening of November 3, 2026, and will be updated.
The theft began as a series of USDC withdrawals from the victim's exchange accounts, not as a breach of the exchanges themselves. On-chain, the pattern is consistent: each receiving address got exactly one withdrawal from an exchange hot wallet, then forwarded the funds into the same small set of wallets.
Ten of the 14 receiving addresses were listed in the public alert. Scorechain analysts identified the other four through the same pattern: a single withdrawal from the same hot wallet, followed by onward transfers into the same first hops and aggregation wallets. Those four received $28.0M between them.
The press coverage also mentions USDT withdrawals. Every exchange withdrawal Scorechain traced for this incident was USDC.
The attacker moved fast and in four clear stages: consolidate the USDC, swap it to ETH, split the ETH, then park it in holding wallets. Converting a freezable stablecoin into ETH within hours is a common step after a large crypto theft, because the issuer can block a USDC or USDT address but cannot freeze ETH.
UniswapX is an intent-based trading protocol: the user signs an order and third-party fillers execute it. For an investigator, the fills still settle on-chain, so the USDC going in and the ETH coming out of the swap wallet remain fully traceable.
As of 05:24 UTC on November 3, 2026, wallets attributed to the attacker still held about $59.9M: $52.8M in ETH, $5.3M in DAI, and $1.8M in USDC, at about $2,250 per ETH. That is down from $73.2M on the evening of November 2. The ten largest balances alone held $50.0M.
At 23:06 UTC on November 2, the largest holding wallet sent 4,450 ETH (about $10.1M) to a new address. That address had received 1.14M USDT minutes before it first appeared, and Tether has since blacklisted it: the USDT contract returns true for its blacklist check, so the 1,142,716 USDT it holds can no longer move.
The ETH is a different matter. A stablecoin blacklist only covers the issuer's own token. Scorechain data shows the same address sent 2,000 ETH (about $4.6M) to a fresh address at 17:10 UTC on November 3, and it now holds about 2,054 ETH. The same address is also receiving zero-value transfers from lookalike addresses that mimic the new recipient's first and last characters, a classic address poisoning pattern that Scorechain AI already flags as Poisoning.
By 20:45 UTC on November 2, funds had started to leave the attributed wallets through two main channels, a typical crypto money laundering sequence after a swap:
The cash-outs follow a recognisable size pattern. Lots of $90K to $100K went to an instant exchange on November 1, deposits of $200K to $535K went to a centralized exchange, and late on November 2, lots of 42 to 45 ETH (about $95K to $102K each) left for fresh addresses, some of which passed them to an instant exchange within minutes.
The press coverage also mentions a conversion to Monero. Scorechain's analysis covers Ethereum, and the services named in that coverage do not appear as counterparties in the attributed Ethereum flows.
VASPs, CASPs, and exchanges should expect deposits of ETH, USDC, or DAI from fresh wallets one or two hops away from the attributed addresses, often in lots of about $90K to $500K. Direct exposure is the easy case; the harder one is indirect exposure through newly created pass-through wallets.
Scorechain's data team rebuilt the flow from the public alert outwards, using the same blockchain forensics workflow available to customers. Crypto tracing here meant following each withdrawal hop by hop, then grouping every wallet that met clear integration rules into one attributed entity.
Not every wallet that touched the funds is attributed. About 30 wallets that were active before October 31, including one that looks like a professional laundering wallet, remain under analyst review. Scorechain attributes only where the on-chain evidence meets its rules. For background on following funds across addresses, see our guide to blockchain transaction tracking.
The public alert reports a loss of more than $106M. On Ethereum, Scorechain traced $108.2M in USDC withdrawn from the victim's exchange accounts to 14 addresses on November 1, 2026. About $60M was still held in attacker-attributed wallets on November 3, mostly in ETH.
Nothing in the on-chain data points to a breach of the exchanges. The funds left as ordinary withdrawals from exchange hot wallets to addresses controlled by the attacker, which is consistent with access to the victim's accounts. How that access was gained has not been established.
Attribution has not been established, and Scorechain does not attribute it. The alert's author wrote that it is "with a high degree of confidence" not the Lazarus Group, based on laundering indicators.
Stablecoins can be frozen by their issuer at the address level: Tether has blacklisted one address in this case, locking 1.14M USDT. Native assets such as ETH cannot be frozen this way, so recovery depends on exchanges and service providers identifying and holding the funds when they arrive.
By screening deposits against the attributed entity and scoring indirect exposure, not only direct counterparties. In this case, funds typically arrived from fresh wallets one or two hops away from attributed addresses, in lots of about $90K to $500K.
Scorechain already flags every address in EU Entity CEX Accounts Exploiter (11-26) and adds new wallets as the funds move. If your team needs to check deposits, score indirect exposure, or investigate a flow like this one, book a demo to see screening, transaction monitoring, and the Exploration Tool on live cases.
