Crypto Investigators Uncover $106M Theft, $786K Solana Bot Drain

European Entity Loses Over $106 Million in Crypto Exchange Accounts

An unidentified entity based in the European Union may have lost more than $106 million from multiple cryptocurrency exchange accounts on Sunday, according to blockchain investigator ZachXBT.

In a post on Monday, ZachXBT stated that the funds, suspected to have been stolen, were withdrawn in USDC and USDT before being moved across various cryptocurrencies and blockchains. The suspected attacker reportedly swapped USDC for Ether (ETH), utilized instant exchange services such as WellWallet and Kyrrex, and converted the funds into Monero (XMR) via the swap service Wagyu.

While the identity of the suspected attacker remains unknown, ZachXBT indicated that the pattern of fund movement did not suggest a link to North Korea’s Lazarus Group. The affected entity and the exchanges involved have not been publicly disclosed. ZachXBT identified 11 wallet addresses associated with the stolen funds.

This reported theft occurs in the wake of the $6.3 billion Binance hack on October 29, which the FBI has attributed to North Korean hackers known as “TraderTraitor,” a group linked to Lazarus. That attack was the largest cryptocurrency theft on record.

Solana Arbitrage Bot Wallet Reportedly Loses $786,000

Separately, a wallet associated with King, an automated trading bot operating on the Solana blockchain, may have lost approximately $786,000 on Monday, according to the pseudonymous blockchain monitoring account Onchain Lens.

King is an arbitrage bot, a type of software designed to profit from price discrepancies by automatically buying cryptocurrency in one market and selling it in another. Onchain Lens informed Cointelegraph that the funds moved through several Solana wallets before being transferred to the Ethereum network using Mayan, a service that facilitates asset transfers between blockchains. The rapid nature of these transfers suggests an attempt to conceal the origin of the funds and a potential wallet compromise.

The operator of King has not yet confirmed any compromise. “Our report is based on unusual fund movements, rapid transfers and the subsequent cross-chain movement of funds, which we believe indicates an attempt to obscure their origin,” Onchain Lens told Cointelegraph. “This pattern strongly suggests a potential wallet compromise.”