The 'Whale' Buying 27,553 ETH Was a Thief: $106M Vanished From 3 Exchanges in 21 Hours — 5 Checks Before Your Coins Are Next

The "whale" that bought 27,553 ETH overnight was not a whale at all. On-chain investigator ZachXBT has tied the wallet to a suspected $106 million theft from an unidentified European entity's accounts at three centralized exchanges — and by the time the buying was spotted, only $3.7 million of the loot was still sitting in freezable stablecoins. The rest had already been swapped into Ethereum, pushed through instant exchanges, bridged across chains, and partly converted into Monero, the privacy coin investigators cannot follow.

This is the fastest-moving crypto theft story of November 2026, and it matters even if you never held a cent on the affected exchanges. It shows, in real time, how a modern crypto theft actually works: not a dramatic hack of an exchange's vaults, but quiet withdrawals from accounts the thief apparently already controlled, laundered in hours through tools anyone can use. Below is the full money trail, what investigators have and have not proven, and the five checks that keep your coins out of the next version of this story.

What Happened: $106 Million Out in 21 Hours

According to ZachXBT's alert, posted to his Telegram channel on November 2, 2026, an attacker withdrew more than $106 million in USDC and USDT on November 1 from multiple exchange accounts belonging to an entity based in the European Union. The victim has not been named, no exchange has publicly confirmed a loss, and the method used to access the accounts has not been disclosed. Treat $106 million as the investigator's estimate, not a confirmed loss — but the on-chain movements behind it are visible, and follow-up reporting counted even more.

A Bitquery trace counted $108.8 million in USDC leaving three exchanges' main wallets for 15 receiving addresses. Kraken supplied about 95%, with OKX and Crypto.com supplying the rest. The first withdrawal left OKX at 12:25 UTC on November 1; Kraken followed 44 minutes later. About $73.2 million — two-thirds of the total — exited in the three hours to 23:00 UTC, and the final payment landed at 09:09 UTC the next morning. One wallet alone received 43 Kraken withdrawals in 91 minutes, each below $50,000 — a pattern that looks designed to dodge per-transaction monitoring.

BeInCrypto's own review found roughly $80 million in USDC arriving at 11 wallets over 11 hours, with about $9.6 million moved out again within three minutes. Speed is the whole story here: this time the money barely stopped moving.

The "Whale" That Wasn't: 27,553 ETH Bought at $2,286

The theft became public because the laundering was loud. At 01:17 UTC on November 2, Lookonchain flagged "whales buying ETH like crazy" after wallet 0x9EcA spent $37.96 million of USDC on 16,658 ETH in two hours. In total it spent $62.97 million at an average of $2,286, accumulating 27,553 ETH. Traders saw aggressive accumulation and assumed a big buyer was positioning. ZachXBT's map, built with investigator Specter and analytics firm TRM Labs, showed the opposite: the USDC had left three exchange accounts on Sunday, passed through dozens of fresh wallets, and landed in 0x9EcA.

Within hours, 0x9EcA passed almost all of its ETH onward: 15,085 ETH to wallet 0x65C3 in eight transfers between 23:46 UTC on November 1 and 00:26 UTC on November 2. That wallet drip-fed funds onward — 3,100 ETH toward a Tron bridge, 2,358 ETH to another address, smaller amounts to at least seven more, plus test amounts to SwftSwap and Rango. As of 14:35 UTC on November 2, 0x65C3 still held 7,844 ETH (about $18 million) while 0x9EcA kept just 310 ETH. Other loot went straight to instant swap services and to Wagyu and Kyrrex, and some was bridged to Tron.

ETH traded at about $2,290 on November 2, almost exactly at the thief's $2,286 average — the $62.97 million of forced buying briefly paid the thief's price back to him. Laundering at this scale is itself a market event, and anyone reading whale alerts without checking where the money came from can mistake crime for conviction.

The Money Trail, Hour by Hour

The timeline below combines ZachXBT's alert, the TRM Labs flow graph, and Bitquery's follow-up trace. Times are UTC; amounts are approximate and the victim and exchanges remain unconfirmed.

When	What happened	Amount
Nov 1, 12:25 UTC	First withdrawal leaves OKX	Part of $108.8M total
Nov 1, ~13:09 UTC	Kraken withdrawals begin; Kraken ultimately supplies ~95%	~$103M via Kraken
Nov 1, to 23:00 UTC	About two-thirds of the money exits in three hours	~$73.2M
Nov 1–2, overnight	Wallet 0x9EcA swaps USDC for ETH, flagged as "whale buying"	$62.97M → 27,553 ETH
Nov 1, 23:46 – Nov 2, 00:26 UTC	0x9EcA forwards ETH to wallet 0x65C3 in eight transfers	15,085 ETH
Nov 2, morning	Final payment lands; ZachXBT posts the alert	Last of $108.8M
Nov 2, 14:35 UTC	0x65C3 still holds a large remainder; only $3.7M remains in freezable USDC	7,844 ETH (~$18M)

Two details matter more than the headline number. First, 11 of the 15 receiving wallets had previously taken payouts from the same exchanges, together receiving 84% of the money. Eight are Trust Wallet smart accounts set up to pay network fees in USDC. Bitquery's conclusion is blunt: the thief most likely held both the exchange logins and those wallets' keys — pointing to someone with prior access to the victim's accounts, not a stranger smashing into an exchange. Second, the operation ran through familiar rails: exchanges the victim already used, wallets already paid, and no-account swap services. Nothing was exotic — which is what makes it replicable.

Why ETH First, Then Monero: The Freezability Clock

The laundering sequence is a textbook in why stablecoins are both the easiest loot and the worst loot to keep. Circle, which issues USDC, can freeze USDC at the issuer level, and Tether can freeze USDT. A thief holding tens of millions in stablecoins is holding an asset someone else can switch off. ETH has no equivalent central issuer — nobody can freeze an Ethereum address — so converting USDC into ETH within hours is the standard first move after a theft, and it is exactly what happened here.

Monero is the harder second step. ZachXBT says part of the funds was converted into Monero (XMR) through the swap service Wagyu. Monero hides senders, receivers, and amounts by default, so once money enters it and exits through another swap or chain, the public trail effectively ends. That is why "only $3.7 million still freezable" matters: it is the portion that had not yet escaped the freezable zone when investigators caught up.

For ordinary holders, the lesson cuts both ways. Stablecoins' freezability is what let Tether and Circle freeze about $2.6 billion after the October 29 Binance hack, and it is a genuine safety net for victims. It is also why you should never assume a stablecoin balance is as censorship-proof as Bitcoin or Ethereum. If you want to understand the trade-off in full, read our guide on whether Tether can freeze your USDT — the answer is yes, and the Binance case showed it happening at extraordinary speed.

Why ZachXBT Says It Is NOT Lazarus — and Why That Matters

One striking line in ZachXBT's alert is a negative: he can say "with a high degree of confidence" that the culprit is not North Korea's Lazarus Group, based on laundering indicators he did not detail. That matters because the timing invited the opposite assumption — the theft landed days after the October 29 Binance hack, a $6.3 billion theft TRM Labs attributed with high confidence to the North Korean TraderTraitor unit, which the FBI has since tied to North Korea with 600+ addresses blacklisted.

ZachXBT is saying this one does not fit: the instant exchanges, the Monero routing, and the previously-paid wallets point toward someone with prior access to the victim's accounts rather than an outside state hacking team. If that holds, the suspect pool is narrower and more uncomfortable — insiders, compromised operators, or a group that obtained the victim's credentials before November 1 — and the usual "North Korea did it" framing would have sent everyone looking the wrong way.

None of this is proven. The victim and exchanges are unnamed, and no law-enforcement agency has confirmed the theft. ZachXBT published 11 Ethereum addresses so the community can track movements, but an investigator's estimate is not a court finding.

What This Is NOT: An Exchange Breach

Coverage of this story needs one careful distinction, because it changes what you should do about it. Early headlines called it a "hack" of exchanges. The evidence so far describes something different: withdrawals from accounts at exchanges, not a breach of the exchanges' own systems. No report has shown customer funds at Kraken, OKX, or Crypto.com being drained from the exchanges' hot wallets, and there is currently no public evidence of a wider breach affecting ordinary customers of those platforms. The victim appears to be a single entity — possibly a company, trading firm, or investment fund — whose own accounts were accessed.

That distinction is why this story sits alongside, rather than on top of, the Binance hack. Our full breakdown of the Binance hack — $6.3 billion stolen and Bitcoin's crash to $76,400 covers an exchange-level breach with a very different attack path. This $106 million case is quieter, more targeted, and in some ways more unsettling: the security failure, if the account-access reading is right, happened on the victim's side of the login screen, not the exchange's side of the vault door. Exchanges can harden their infrastructure all they like; they cannot stop a thief who logs in with valid credentials and valid wallet keys.

The 5 Checks That Keep Your Coins Out of the Next One

Every major theft of 2026 has the same epilogue: a checklist that would have stopped it, published after the money is gone. Here is this case's version, written while the trail is still warm. Run through it for every exchange account and wallet you control — it takes about fifteen minutes and it addresses the exact failure mode this theft suggests.

1. Hardware security keys, not SMS codes. If your exchange account is protected by SMS two-factor authentication, a SIM-swap or a compromised phone can hand a thief the login. Switch to an authenticator app at minimum, and to a hardware security key where the exchange supports it. This is the single highest-leverage change most holders have not made.
2. Withdrawal allowlisting, locked on. Allowlist your own wallet addresses and enable the withdrawal address lock or delay if your exchange offers it. A thief with your login but not your allowlist cannot send funds to a fresh wallet — and the 24-to-48-hour delay on changing allowlisted addresses is exactly the window that lets a real owner notice and stop a drain like this one.
3. Separate your trading stack from your savings stack. Keep only trading funds on exchanges. Move the rest to a hardware wallet you control, with the seed phrase stored offline and never photographed, typed into a website, or pasted into a chat. Our ranking of the best hardware wallets in November 2026 covers the options worth considering after a month like this one.
4. Audit payout wallets and API keys quarterly. The Bitquery finding — 11 of 15 receiving wallets had been paid before — is a warning about stale access. Review which wallets your exchanges have paid, which API keys are active, and which devices and sessions are logged in. Revoke anything you do not recognize immediately, and treat an unfamiliar payout wallet as an incident, not a curiosity.
5. Never trust a "whale alert" at face value. Large buys move markets, but large buys can also be laundering. Before you follow a whale into a trade, check whether the buying wallet was funded from an exchange minutes earlier, whether it is a fresh address, and whether investigators have flagged it. A few minutes on a block explorer beats a few thousand dollars chasing someone else's crime.

If you want the full version of this discipline, our guide to protecting your crypto from hacks and scams in 2026 walks through exchange settings, wallet hygiene, and the phishing traps that still catch experienced holders. And if the Monero step in this theft made you curious about privacy tools, our explainer on what a DEX is — and the record 23% of spot trading they now handle covers the no-account trading rails that thieves and legitimate traders both use, and how to tell the difference.

What Happens Next: Recovery Odds and the Investigation

Recovery from a theft like this is a race against the freezability clock, and most of the clock has already run. The $3.7 million still in USDC is the freezable remainder; Circle can act on it if a victim or law-enforcement request lands with the right wallet addresses. The ETH sitting in wallets like 0x65C3 can be watched — every move is public — and exchanges can be warned to freeze deposits from flagged addresses, which is why ZachXBT published the 11 addresses. But ETH cannot be frozen at the protocol level, and each hop through an instant exchange, a bridge, or a Monero swap degrades the trail.

Partial recovery is the realistic ceiling. In the Binance case about $3 billion of $6.3 billion was frozen, while the hacker's unfreezable Bitcoin sits in wallets nobody can seize. Here, with most stablecoins already converted, the recoverable share is likely far smaller unless the victim's identity surfaces quickly.

Watch for three developments. First, a victim statement or exchange confirmation — either would convert an investigator's estimate into a confirmed loss and unlock formal freeze requests. Second, movement from 0x65C3's remaining 7,844 ETH: further bridging to Tron or fresh Monero conversions would signal the laundering is still active. Third, any law-enforcement attribution: if the account-access reading holds, the investigation becomes a credentials-and-insider case, not a sanctions-and-blocklist case, and its timeline will look very different.

What It Means for Prices: ETH at the Thief's Average

Short-term, the market impact looks contained — and that itself is informative. ETH traded near $2,290 on November 2, almost exactly the thief's $2,286 average, and the broader market's November 3 slide toward $77,000 for Bitcoin and $2,250 for ETH was driven far more by midterm-election hedging, tech-stock weakness, and $365.9 million in liquidations than by this theft. A $106 million theft is enormous for its victim and trivial against a $2.67 trillion market; it does not set prices, it just rides them.

The longer effect is on trust, not charts. Two exchange-adjacent incidents in five days reinforce the message that drove $3.64 billion off exchanges after the Binance hack: custody is the trade of this cycle, and decentralized exchanges just hit a record 23% of spot trading.

Frequently Asked Questions

Was $106 million really stolen?

Not confirmed — yet. ZachXBT, a respected on-chain investigator, flagged a suspected theft of more than $106 million from an EU entity's exchange accounts, and Bitquery's independent trace counted $108.8 million in USDC movements matching the pattern. But neither the victim nor any exchange has publicly confirmed a loss, so the figure remains an investigator's estimate based on visible on-chain flows.

Which exchanges were involved?

ZachXBT did not name them, and the TRM Labs flow graph labels the sources only as Exchange 1, 2, and 3. Bitquery's trace identified Kraken as the source of about 95% of the USDC, with OKX and Crypto.com supplying the rest, based on the exchanges' main wallets. That identification is Bitquery's analysis, not an admission by any exchange.

Was this the Lazarus Group?

ZachXBT says no — with a high degree of confidence, based on laundering indicators he did not detail. That contrasts with the October 29 Binance hack, which TRM Labs attributed with high confidence to the North Korean TraderTraitor unit. The distinction matters because it points investigators toward an account-access case rather than a state-hacking case.

Can the stolen funds be recovered?

Partly, at best. About $3.7 million remained in freezable USDC when the trail was published, and flagged ETH wallets can be watched and their exchange deposits frozen. But ETH cannot be frozen at the protocol level, and funds converted to Monero are effectively untraceable through public chain analysis. Full recovery is unlikely.

Are ordinary Kraken, OKX, or Crypto.com customers at risk?

There is currently no public evidence of a wider breach affecting ordinary customers. The evidence points to a single entity's accounts being accessed, not to the exchanges' systems being compromised. Standard precautions still apply: hardware two-factor authentication, withdrawal allowlisting, and keeping long-term holdings off exchanges.

Why did the thief buy ETH instead of keeping USDC?

Because USDC can be frozen by its issuer, Circle, while ETH cannot be frozen by anyone. Swapping stablecoins for ETH immediately after a theft is the standard first laundering step: it converts a freezable asset into an unfreezable one before freeze requests can land. The Monero step that followed goes further, hiding the trail itself.

Conclusion

The $106 million theft will probably never have a clean ending — no named victim, no arrested thief, no full recovery. Its value is as a warning with receipts: a wallet that looked like a whale was a thief, $108.8 million left three exchanges in 21 hours through wallets those exchanges had paid before, and only $3.7 million was still freezable when anyone noticed. The defenses that would have mattered were not exotic — hardware two-factor authentication, withdrawal allowlisting, cold storage, and a quarterly audit of who can move your money. Run the five checks today, before your account is the next case study.

Sources: ZachXBT's November 2, 2026 Telegram alert as reported by Unchained and BeInCrypto; the whale-wallet analysis via TradingView / 99Bitcoins; Bitquery's wallet-history trace via Coindoo; and the summary in CoinLab. This article is for information only and is not financial advice; the theft remains unconfirmed by the victim or the exchanges named in third-party analysis.