- Published on
Crypto investigators flag suspected $106M theft, $786K Solana bot drain
- Authors
- Name
- DeepHorus
An unidentified European entity may have lost more than $106 million from accounts at multiple cryptocurrency exchanges on Sunday, according to blockchain investigator ZachXBT. The suspected theft was flagged in a Monday post, in which ZachXBT said funds were withdrawn in USDC and USDT before being moved through several cryptocurrencies and blockchains. The affected entity and exchanges involved have not been publicly named.
The suspected attacker swapped USDC for Ether (ETH), used instant exchange services including WellWallet and Kyrrex, and converted funds into Monero (XMR) through the swap service Wagyu. ZachXBT identified 11 wallet addresses associated with the funds. He added that the movement of funds pointed away from a link to North Korea’s Lazarus Group, though the attacker remains unidentified.
The reported theft follows the $6.3 billion Binance hack on Oct. 29, which the FBI has attributed to North Korean hackers known as “TraderTraitor,” a group linked to Lazarus. That attack was the largest cryptocurrency theft on record.
Separately, a wallet associated with King, an automated trading bot on Solana, may have lost about $786,000 on Monday, according to pseudonymous blockchain monitoring account Onchain Lens. King is an arbitrage bot that automatically buys cryptocurrency in one market and sells it in another to profit from price differences.
Onchain Lens told Cointelegraph that the funds moved through several Solana wallets before being transferred to Ethereum using Mayan, a service for moving assets between blockchains. It said the rapid transfers suggested an attempt to conceal the funds’ origin and a possible wallet compromise. King’s operator has not confirmed a compromise.
“Our report is based on unusual fund movements, rapid transfers and the subsequent cross-chain movement of funds, which we believe indicates an attempt to obscure their origin,” Onchain Lens told Cointelegraph. “This pattern strongly suggests a potential wallet compromise.”
The incidents highlight growing risks in cryptocurrency, where attackers increasingly use cross-chain swaps and privacy coins to obfuscate trails. Investigations into both cases are ongoing, but no suspect has been publicly identified. The crypto community is urged to bolster security measures as authorities continue to trace the stolen funds.
