Update (Nov. 3, 2026, 8:08 pm UTC): The headline has been clarified to specify that Kraken’s account restrictions relate to accounts linked to the suspected theft. Kraken says its systems and customer accounts were not compromised.
Update (Nov. 3, 2026, 11:51 am UTC): This article has been updated with a revised headline and responses from Kraken, OKX and Crypto.com.
Kraken has restricted accounts linked to a suspected crypto theft of more than $133 million from an unidentified European Union entity and is working with law enforcement to support recovery efforts.
“This incident did not originate on the Kraken platform, and we’re actively investigating reports that some of the assets were subsequently moved through accounts on our platform,” Kraken told Cointelegraph. “We’ve restricted the accounts in question and are working with law enforcement to support recovery efforts.”
Kraken’s statement follows blockchain investigator ZachXBT’s disclosure on Tuesday that he identified another $27 million in withdrawals from centralized exchanges, increasing the suspected losses from the $106 million he reported on Monday. He said some withdrawals occurred after his initial disclosure.
Bitquery reported that the suspected stolen funds were withdrawn from accounts at Kraken, Crypto.com and OKX. It also found that $62.98 million in stablecoins was converted into 27,553 Ether (ETH) within roughly four hours.
Kraken said its security systems had not been compromised, no customer accounts had been taken over and there was no ongoing risk to its customers.
Crypto.com told Cointelegraph that it had taken steps to prevent funds associated with the incident from moving through its platform.
“We are aware of this report and have taken appropriate action to block any funds associated with this third-party incident from moving through Crypto.com,” a spokesperson said. “Our platform remains fully operational, and all user funds are secure and accessible.”
OKX acknowledged Cointelegraph’s request for comment and said it was looking into the matter.
As of 13:47 UTC Monday, approximately $78.3 million remained in wallets linked to the suspected attacker, while $30.5 million had moved out of the tracked addresses, according to Bitquery. Only $3.74 million remained in USDC that issuer Circle could potentially freeze, while Tether had already frozen $1.1 million in USDT.
Victim’s identity remains unverified
“My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up,” ZachXBT said on his Telegram channel.
He also said the lack of a proper incident disclosure allowed more than $30 million to be laundered, claiming EU law enforcement could otherwise have frozen the funds. The victim’s identity and allegations of a cover-up remain unverified.
ZachXBT said earlier that the attacker was swapping funds into ETH and Monero (XMR) through instant exchanges and cross-chain bridges. He said the laundering patterns did not match those typically used by North Korea’s Lazarus Group.
Related: North Korea denies role in $6.3B Binance hack, points finger at US
