What happened to the $106 million stolen from an EU entity's exchange accounts?

A sophisticated exploit targeted an EU-based entity's accounts across multiple exchanges, resulting in a $106 million loss that is currently being laundered through Ethereum and Monero. The theft, flagged by investigator ZachXBT in early 2026, highlights critical vulnerabilities in institutional API security and cross-exchange custody.
What happened to the $106 million stolen from an EU entity's exchange accounts?

The $106 million theft occurred when a large EU-based entity suffered a coordinated breach across several centralized exchange accounts, allowing attackers to drain massive amounts of liquidity. On-chain analyst ZachXBT discovered the exploit, noting that the perpetrators are rapidly converting the stolen assets into Ethereum (ETH) and the privacy-centric coin Monero (XMR). This maneuver is a classic obfuscation tactic designed to prevent exchanges from freezing the funds and to break the visible trail on public ledgers.

Preliminary investigations suggest that the breach likely involved the compromise of API keys or administrative credentials, rather than a direct exploit of the exchanges' underlying security. By hitting multiple accounts simultaneously, the attackers were able to circumvent traditional withdrawal caps and security alerts that typically trigger during a single large outflow. The movement of such a significant sum into ETH and XMR indicates a highly professional operation prepared for immediate laundering.

From a regulatory perspective, this event puts the European Union's MiCA (Markets in Crypto-Assets) framework under the spotlight. While MiCA provides a comprehensive legal structure, this incident demonstrates that even regulated entities remain vulnerable to high-level social engineering or internal security lapses. For US-based institutional investors, this serves as a stark reminder of the risks associated with third-party custody and the importance of implementing multi-signature approvals for all exchange-based movements.

Market participants are currently watching for potential sell pressure on ETH as the hackers move to exit their positions. Furthermore, the use of Monero once again places privacy coins in the crosshairs of global regulators who argue that such assets facilitate illicit financial flows. Readers should monitor ZachXBT’s updates for specific wallet addresses to see if any major centralized exchanges successfully blacklist the associated accounts or if the funds disappear into the Monero ecosystem.

Editorial method

This report is based on the linked source and is labeled with its publication date, provider, category and market-impact assessment. Market interpretation is informational, not investment advice.