EU Entity Crypto Theft: $106M Drained, Not Lazarus

An unnamed European Union entity is suspected of losing more than $106 million from exchange accounts on November 1. The alert comes from the on-chain investigator ZachXBT, as reported by CoinDesk. Nobody has confirmed the loss. Here is the EU entity crypto theft in plain terms: what is claimed, what is not known, and what miners should lock down.

What ZachXBT says about the EU entity crypto theft

ZachXBT posted the alert on Telegram on Monday, November 2. He says the losses happened on Sunday across multiple centralized exchanges. He did not name the victim or the exchanges, and he did not say how the attacker got in. CoinDesk notes the “entity” could be a company, a trading firm or a fund.

According to ZachXBT, the attacker withdrew the stablecoins USDC and USDT. Over the next 24 hours the attacker swapped USDC for ether. The funds then moved through the instant-exchange services WellWallet and Kyrrex, and some were converted into Monero using Wagyu. Unchained reports the same flow. He published 11 linked wallet addresses.

What is not confirmed

Neither the entity nor any exchange has publicly confirmed the theft. The $106 million figure is ZachXBT’s estimate. He also wrote that he is highly confident it is not the Lazarus Group, based on laundering patterns, while the attacker remains unidentified. That matters because the FBI has pointed to a Lazarus-linked group for the Binance theft, so this looks like a separate case.

One point is clear from CoinDesk’s reporting. Issuers can freeze USDC and USDT, but they cannot freeze ether or Monero. Once the attacker swapped into those, the clock on any freeze had mostly run out.

Why exchange accounts are the weak spot

This is the third theft story in a week. Binance put its impacted client assets at about $6.3 billion, and Brazil’s Mercado Bitcoin halted withdrawals after a hack of about $40 million, per Decrypt. This one differs: the funds sat in exchange accounts, not in a protocol. We do not know the method, so we will not guess. We can still say what shrinks the risk for anyone who holds coins on an exchange.

First, turn on a withdrawal address allow-list, so funds can only go to addresses you approved. Second, use a hardware key for two-factor login, not SMS. Third, keep only trading balances on the exchange. For miners, point pool payouts at your own wallet, so no exchange sits in the middle.

What it means for miners

The theft does not touch the network. Hashrate is about 1,040 EH/s and bitcoin is near $76,862. A stolen balance on an exchange is not a change in block rewards. The risk is to your coins, not your machines.

Miner math: what your machine earns today

Here is the live maths on November 2. Bitcoin is $76,862 and the network is 1040 EH/s, so hashprice is about $33.49 per petahash per day. That is what one PH/s of hashing earns before power.

Numbers are profit per day after electricity, at the three power prices shown. Break-even is the most you can pay per kilowatt-hour before the machine loses money. Specs are the manufacturer ratings; network data comes from mempool.space. Try your own power price in our free bitcoin mining profit calculator. See what these machines really sold for in our used ASIC miner price index. Want to run the same numbers on a machine you can buy today? See our used ASIC miners, or buy several at once through bulk lots.

The theft itself does not move hashprice. For scale, if bitcoin fell 10% on more exchange fear: the break-even power price on an S19k Pro falls from 6.1 to 5.5 cents per kilowatt-hour. At 8 cents, daily profit goes from -$1.23 to -$1.61.

Our blunt view: if you mine, the safest exchange account is one that holds little. Get paid to your own address and sell on your schedule.

For the maths behind break-evens, see our mining economics guides. You can also browse every miner in stock, or check where bitcoin may go next.

-Nick
ING Mining

This is general information, not financial advice. Crypto is volatile, and exchanges can fail. Please do your own research.