Crypto Whodunit: $108.8 Million in USDC Drained From Kraken, Crypto.com, and OKX in a Coordinated Two-Day Withdrawal
Blockchain analytics firm Bitquery tracked a massive outflow of stablecoins from three major exchanges, prompting swift responses from the platforms involved and raising fresh questions about the security of centralized digital-asset services.
The cryptocurrency industry was put on high alert this week after blockchain analytics firm Bitquery tracked the withdrawal of approximately $108.8 million in USD Coin from three of the most prominent digital-asset exchanges in operation — Kraken, Crypto.com, and OKX — all within a compressed 48-hour window spanning November 1 and November 2. The funds, according to the firm’s on-chain data, were dispersed rapidly across hundreds of individual wallet addresses before a substantial share was converted into Ether, the native token of the Ethereum network. The scale of the movement alone was enough to turn heads in trading rooms and security channels across the sector. But it was the choreography behind the withdrawals that truly unsettled professionals. A capital outflow of this magnitude, spread so deliberately across so many separate recipients, does not resemble the routine treasury operations of an institutional client. It carries the fingerprints of a coordinated effort designed to obscure the destination of the funds and frustrate any attempt at forensic reconstruction. As of this writing, the identity of the individual or group responsible remains unknown, and the specific method by which they obtained access to the affected accounts has yet to be determined. The episode has reignited a long-simmering debate about the security of centralized exchanges, the limits of their internal monitoring systems, and the uncomfortable truth that, in a permissionless monetary network, the very features that make digital assets efficient also make them an inviting target for sophisticated adversaries. For the wider market, it is a stark reminder that no platform is immune to the persistent threat of unauthorized access — and that the decentralization underpinning the crypto ethos can cut both ways when malicious actors turn it to their advantage. News of the outflow circulated quickly through trading desks and cybersecurity circles, with analysts flagging the event as one of the more unusual large-scale fund movements of the year. For now, the most pressing concern for exchange operators is not merely the immediate financial fallout, but the erosion of trust that such incidents inevitably bring — and the certainty that the attackers, wherever they are, are already watching to see how the defenders respond.
At the heart of the industry’s concern lies a crucial technical detail that has shaped the entire investigation: the decision to route a significant portion of the withdrawn capital into Ether. USDC is a fiat-backed stablecoin issued by Circle, and its smart contract includes a blacklist function that allows the issuer to freeze designated addresses when funds are suspected of being tied to illicit activity or sanctioned entities. That freeze capability has become one of law enforcement’s most powerful weapons against cryptocurrency crime, enabling authorities and compliant platforms to immobilize stolen assets before they can be laundered or converted into fiat currency. Ether, however, operates beyond the reach of any such mechanism. As the native cryptocurrency of the Ethereum blockchain, it has no central issuer, no blacklist, and no kill switch. The moment USDC is swapped for Ether, the funds become, for all practical purposes, untouchable by centralized authority. Security specialists describe this as a time-honored playbook in digital-asset heists: move the loot into a freeze-resistant asset as quickly as possible, ideally before the victim has even noticed the loss. In this case, the conversion appears to have been executed with notable speed and precision, compounding the difficulty of recovery. The deliberate dispersion of the original USDC across hundreds of wallets adds yet another layer of complexity — a method intended to overwhelm automated risk-monitoring systems and force responders to painstakingly reconstruct the trail by hand. Taken together, these elements point to an actor or actors with a sophisticated command of blockchain architecture, regulatory vulnerabilities, and the operational constraints that bind exchange security teams. Regulators, watching closely, will likely read the incident as proof that the power to freeze stablecoins, however effective in other contexts, can be circumvented in a matter of minutes by anyone determined enough to try. Whether the pattern points toward an inside job, a coordinated external breach, or a hybrid of the two remains a matter of intense speculation among the analysts tracking the case.
Amid these questions, the exchanges themselves have begun to respond — though with varying degrees of transparency. Crypto.com announced that it had prevented funds linked to the attack from being transferred through its platform, a statement that suggests at least some of the contested assets were intercepted before they could exit the ecosystem. OKX, for its part, reported that it detected unusual activity in a corporate client account, moved decisively to freeze it, and contacted the client directly to inform them of the breach. Both platforms took pains to emphasize that accounts belonging to ordinary retail users were not affected, a reassurance intended to shore up customer confidence and stave off potential panic. Kraken, however, did not respond to requests for comment at the time this report was published, and its silence has naturally become a topic of conversation within the cryptocurrency community. Whether the lack of a statement reflects a cautious legal posture, an ongoing internal review, or an indication that the exchange was not ultimately a target remains unclear. What is evident is that incident-response practices among major exchanges have matured considerably since the industry’s turbulent early years. The days of a single catastrophic loss crippling an entire platform are largely gone, replaced by layered security frameworks, dedicated monitoring teams, and close partnerships with blockchain intelligence firms. Yet the present case illustrates just how quickly events can escalate, and how much remains dependent on the vigilance of a relatively small number of personnel entrusted with safeguarding billions in customer capital. The fact that a corporate client account was singled out at OKX adds another wrinkle, suggesting the attackers may have deliberately targeted institutional-scale balances rather than spreading their efforts across many smaller victims. The differences in how these three platforms have handled the episode — the disclosures made, the language chosen, the silence maintained — will likely be dissected in boardrooms and security conferences for months to come.
Yet for all the official statements, the most unsettling question — perhaps the one that will shape how the industry treats this incident for years to come — is how the attacker gained access in the first place. At this stage, the investigation has not established a definitive entry vector, and those familiar with the matter have been careful not to speculate publicly. In the broader history of cryptocurrency-related crime, however, several familiar avenues loom large. Targeted phishing campaigns designed to harvest the credentials of high-value or corporate users have long been a preferred method of entry. API key compromises, in which attackers obtain the digital credentials that allow automated trading and withdrawals, have repeatedly exposed vulnerabilities in exchange platforms. SIM-swapping attacks — a technique in which a criminal convinces a mobile carrier to reassign a victim’s phone number to a device under their control — have been used time and again to gut two-factor authentication and seize control of accounts. What makes this case particularly striking is the apparent breadth of the operation. Penetrating a single exchange account is one thing; coordinating withdrawals from three separate platforms within a 48-hour period implies either a wide-reaching breach of cross-platform credentials, an extraordinarily sophisticated identity-compromise strategy, or some combination that involves an insider element at one or more points in the chain. The dispersal of the funds across hundreds of wallets is likewise characteristic of a professional laundering operation, the kind associated with organized cybercrime rather than opportunistic hacking. Until investigators trace the destination addresses back to a point of fiat conversion or exchange cash-out — a process that typically takes weeks and requires cooperation among exchanges, regulatory bodies, and analytics firms — the attack vector will remain a matter of educated guesswork. What is certain is that the industry’s security teams are now racing to identify and close whatever loophole made this possible before the same method can be deployed elsewhere.
While the method remains a mystery, a parallel question — who is responsible — has already generated a striking preliminary answer from one of the crypto world’s most prominent independent investigators. ZachXBT, a pseudonymous on-chain researcher with a large following and an impressive track record of unmasking cryptocurrency criminals, has stated that, based on the manner in which the funds were moved, they are highly confident that the North Korea-linked Lazarus Group is not behind this operation. That assessment carries weight. The Lazarus Group, widely believed to operate under the direction of North Korea’s intelligence apparatus, has been implicated in some of the largest cryptocurrency thefts in history, including the infamous Axie Infinity Ronin bridge hack and an array of other high-profile exploits conducted under the regime’s banner. The group has built a reputation for highly disciplined, methodical laundering operations and is consequently the first suspect raised whenever significant sums vanish from the blockchain. ZachXBT’s conclusion, which they shared citing the specific movement patterns observed in this case, suggests that the fingerprints here do not match those of the North Korean operatives. It is important to stress, however, that this is the analysis of an independent researcher rather than the result of an official law enforcement investigation, and the distinction is a meaningful one. Should the Lazarus theory indeed be ruled out, the field of alternative suspects widens considerably: organized criminal syndicates operating free of state sponsorship, sophisticated independent hacking collectives, or individuals with deep familiarity with the crypto ecosystem and access to privileged information about its major platforms. The difficulty of attribution is itself a problem for the industry, which relies on identifying threat actors to anticipate their future behavior and protect against the next attack.
Whatever the investigation ultimately concludes, the episode offers a revealing snapshot of the challenges confronting the cryptocurrency industry as it matures into a mainstream financial sector. The architecture that makes digital assets so compelling — open access, instantaneous settlement, and a meaningful degree of anonymity — is the same architecture that creates the conditions for exploitation. Centralized exchanges have made enormous strides in hardening their defenses, yet the threat landscape continues to evolve in tandem. The use of freeze-resistant cryptocurrencies represents a new wrinkle in the age-old battle between law enforcement and financial crime, one that will undoubtedly shape future policy debates around stablecoin regulation and the obligations of exchanges to monitor their users’ withdrawal patterns. The incident also underscores the growing influence of blockchain intelligence firms and independent investigators, whose ability to reconstruct complicated on-chain flows has transformed public understanding of these events. At the same time, the continuing opacity around the entry vector and the identity of the perpetrator serves as a humbling reminder that even the most sophisticated analytics have limits in the midst of an active operation. For ordinary investors and exchange users, the practical lessons are familiar but worth reiterating: enable robust security measures, remain alert to phishing attempts, and recognize that no platform, no matter how established, is altogether immune to compromise. For the industry as a whole, the hope is that the lessons drawn from this incident — once fully understood — will produce stronger safeguards, sharper surveillance systems, and a more resilient foundation for the next stage of growth. The story is still developing, and the coming weeks are likely to bring further disclosures. This article is for informational purposes only and does not constitute investment advice.
