Kraken has frozen a set of accounts connected to a crypto theft now estimated above $133 million, after on-chain investigators traced most of the withdrawals through its platform. The victim, an entity in the EU, has not been named by any authority or company. Kraken says the theft did not start on its exchange, its defences were not breached, no customer account was taken over, and customers face no ongoing risk. It says it is cooperating with law enforcement on recovery. Crypto.com has blocked money tied to the case, and OKX says it is reviewing the claims.
Investigator ZachXBT first put the figure at $106 million on Monday, November 2. A day later he added $27 million more, found in fresh withdrawals from exchange accounts, taking the estimate past $133 million. The withdrawals themselves happened on November 1, through normal exchange channels rather than any hack of an exchange. Ledger Insights followed $108 million in USDC moved on November 1 and 2: $102 million exited via Kraken, $5.4 million via Crypto.com, and $660,000 via OKX. On November 1, thirteen separate Kraken withdrawal addresses fired one after another across six hours; several first received a $1,000 probe, then the entire balance — usually $5 million to $10 million — sixty seconds later. Two further withdrawals came the next day, after the first alert went out. Bitquery's numbers show stablecoins worth $62.98 million turning into 27,553 ETH across about four hours, and from there the trail ran through instant-swap services and bridges, with part of the haul ending up in Monero.
That split is the story. Kraken handled $102 million of the $108 million. The exchange was the exit, not the victim.
Nobody has confirmed who lost the money, or how it was taken before it reached the exchanges — that part is not visible on chain. ZachXBT's own theory, posted to his Telegram channel, points to a major finance firm based in Western Europe and claims the incident is being hushed up. That attribution is his alone; it is unverified, and no victim has stepped forward with a disclosure. He also argues the laundering trail looks different from the Lazarus Group's usual methods, and says he is highly confident North Korea's crew is not behind this one.
Why it matters
The contrast with the week's other exchange story is sharp. The Binance $6.34 billion hack was a theft from inside an exchange's own systems. Here the exchanges appear to be the road out for money stolen elsewhere — and that raises a different question: how quickly does a platform spot and freeze suspect withdrawals once an on-chain alert lands, even when its own vaults were never touched? The FBI naming of North Korea behind the Binance theft showed how fast attribution can harden into a headline. Here the attribution is still one investigator's theory, and the distance between on-chain proof of movement and proof of the original theft is where traders should stay careful.
Recovery already looks like a race against the clock. Bitquery's Monday 13:47 UTC snapshot put about $78.3 million still sitting in wallets tied to the suspected thief, with $30.5 million already gone from the monitored addresses. Tether froze $1.1 million in USDT. Circle could still freeze only $3.74 million in USDC. Once stablecoins become ether and then Monero via instant-swap services, freezing stops being an option and the case rests on exchanges cooperating with investigators.
The money trail
| Flow | Figure | Source |
|---|---|---|
| Total suspected theft | Over $133 million | ZachXBT, via Cointelegraph |
| First flag, Monday Nov 2 | $106 million | ZachXBT |
| Added Tuesday Nov 3 | $27 million of exchange withdrawals | ZachXBT |
| USDC via Kraken, Nov 1–2 | $102 million of $108 million | Ledger Insights |
| USDC via Crypto.com | $5.4 million | Ledger Insights |
| USDC via OKX | $660,000 | Ledger Insights |
| Stablecoins turned into ether | $62.98 million for 27,553 ETH, ~4 hours | Bitquery |
| USDT frozen by Tether | $1.1 million | Bitquery |
| USDC still freezable by Circle | $3.74 million, Monday 13:47 UTC | Bitquery |
What to watch
- Whether the unnamed victim discloses the incident, and whether ZachXBT's total climbs past $133 million as more withdrawals surface.
- What OKX does next: so far it has only said it is reviewing the claims, while Kraken and Crypto.com have already acted.
- Further freezes or seizures tied to the tracked wallets, and any law-enforcement statement naming the victim or the attacker.
- Whether other exchanges tighten large stablecoin withdrawal reviews after two theft stories in one week put exchange controls in focus.
Key points
- Kraken froze accounts tied to a theft estimate above $133 million from an unnamed EU entity; it says its systems were not breached and customer funds are safe.
- ZachXBT's estimate rose from $106 million on November 2 to over $133 million on November 3, after $27 million more in exchange withdrawals turned up.
- Ledger Insights followed $108 million in USDC out on November 1–2: $102 million via Kraken, $5.4 million via Crypto.com, $660,000 via OKX.
- Bitquery counts stablecoins worth $62.98 million swapped for 27,553 ETH across about four hours, then routed through instant-swap services and bridges into Monero.
- Tether's freeze covered $1.1 million in USDT; Circle could still freeze only $3.74 million in USDC as of Monday 13:47 UTC.
- The victim's identity and ZachXBT's Western Europe theory are unverified; no authority has confirmed an attack happened.
MarketRadar take
For traders, the direct read is narrow: Kraken says its platform runs normally, deposits and withdrawals work, and no customer account was taken over — so on the facts available now, this is not a Kraken solvency or security event. The wider read concerns exchange plumbing. A week that already held a $6.34 billion exchange hack now holds a second case where exchanges moved the money out, and that combination tends to pull regulators and compliance teams toward withdrawal controls and faster freeze coordination. Watch for a victim disclosure: a named institution would turn an on-chain mystery into a concrete counterparty story, while continued silence leaves the $133 million figure as one investigator's estimate rather than a confirmed loss.
