EU entity suspected of losing $106 million from crypto exchange accounts, ZachXBT says

We have a problem in the institutional sector that nobody likes to talk about. We spend all this time building complex DeFi protocols and high-speed chains, but the moment the money moves into centralized custodial accounts, it seems to vanish into thin air. The latest example comes from an investigation by ZachXBT, who identified a staggering $106 million loss linked to an entity based in the European Union.

As of right now, we do not have a name for the victim. We do not even have a confirmed list of which exchanges were compromised. What we do have is a trail of breadcrumbs that tells a very familiar, very frustrating story about how easily large-scale capital can be moved, obfuscated, and essentially deleted from the reachable financial system.

The Mechanics of the Drain

The attacker did not just stumble into a hundred million dollars. This was a methodical extraction. According to the on-chain data, the funds were siphoned from various exchange accounts and immediately converted into Ether. This is standard procedure for high-level thefts; you move into a liquid, non-stable asset as quickly as possible to avoid centralized issuers like Circle or Tether freezing the tokens.

Once the funds were in ETH, the attacker began a complex laundering process. They utilized instant exchanges—services that allow you to swap one coin for another without creating a full account or undergoing rigorous KYC. From there, the trail leads into Monero. For those who do not follow the privacy space closely, Monero is the end of the line for most investigators. Once a fund enters the XMR ecosystem, the transparency of the public ledger is gone.

For builders, this is a wake-up call regarding the limits of current tracking technology. We often brag about the transparency of the blockchain, but that transparency is a choice. When a sophisticated actor chooses to go dark, they have the tools to do it effectively.

The Institutional Security Illusion

Why does this keep happening to large entities? The EU-based victim in this case was likely using an institutional-grade custody solution. These are the products that are sold to us as the gold standard of safety. They come with multi-sig requirements, insurance policies, and SOC2 compliance. Yet, $106 million still walked out the door.

The issue usually is not the math behind the cryptography. It is the human layer. Whether it was a session hijacking, a compromised API key, or an inside job, the result is the same. Large firms often prioritize convenience and ease of trading over cold-storage security. They want to be able to move millions in a few clicks to catch a market swing, and that desire for speed creates a massive attack surface.

The uncomfortable truth is that institutional custody is often just a prettier wrapper for the same centralized risks we have seen since the Mt. Gox days.

What This Means for Builders

If you are building in the infrastructure space, you need to look at this incident as a case study in why user experience and security are still at odds. We have not yet found the middle ground where a firm can manage nine figures of capital without being one phishing email away from bankruptcy.

Here are three things we should be thinking about:

• API Granularity: Most exchange APIs are too powerful. If an attacker gets an API key, they should not have blanket withdrawal permissions. We need better default settings that require hardware-based secondary approval for any movement of funds to new addresses.
• Latency in Withdrawals: We need to stop treating instant withdrawals as a feature. For institutional accounts, a forced 24-hour delay on large outflows could have saved $100 million here. It gives the security team time to breathe and react.
• Privacy Tech for Good: We need to stop pretending that Monero and mixers are the only way to achieve privacy. If we do not build compliant, privacy-preserving tools for legitimate actors, the only people using privacy tech will be the ones who just stole $106 million.

The Regulatory Fallout

Because this involves an EU entity, we can expect the regulatory response to be heavy-handed. The Markets in Crypto-Assets (MiCA) regulation is already tightening the screws on how assets are held and reported. An incident of this scale will only embolden regulators to demand even more invasive oversight into how exchanges operate their internal ledgers.

The irony is that more regulation does not necessarily lead to more security. You can have all the paperwork in the world, but if your lead dev uses a compromised browser extension, the money is gone. We are trying to solve technical and human errors with administrative red tape, and it rarely works.

The Founder Perspective

If you are a founder running a treasury, you have to be paranoid. I have talked to dozens of founders who think they are safe because they use a reputable exchange. This news proves that reputation is not a shield. If you are holding significant capital on an exchange for the sake of liquidity, you are taking a massive, uncompensated risk.

We need to move back toward the "not your keys, not your coins" ethos, even at the enterprise level. The technology for self-custody has improved significantly with MPC (Multi-Party Computation) and better hardware wallets. There is no excuse for a hundred-million-dollar entity to be this vulnerable.

A Final Reality Check

We probably will not get the $106 million back. ZachXBT is arguably the best in the business at following the money, but even he hits walls when Monero enters the chat. The exchanges involved will likely stay quiet to protect their own reputations, and the victim will likely try to settle things behind closed doors with their insurers.

But the industry sees it. The ledger does not lie. We are still in the Wild West, regardless of how many suits and ties enter the room. If we want to build a financial system that lasts, we have to stop building glass houses and expecting people not to throw stones.

The takeaway is simple: Centralized points of failure are still the biggest threat to crypto adoption. Until we can secure institutional-scale funds without relying on the honesty of a few API endpoints or the privacy of a single entity, we are just waiting for the next headline.

Read the original at CoinDesk →