Key Highlights
- Blockchain analytics firm Bitquery identified $108.8 million in USDC withdrawals originating from accounts across Kraken, Crypto.com, and OKX on November 1–2.
- Perpetrators dispersed the assets across hundreds of wallets and swapped substantial sums into Ether to prevent centralized freezing.
- Crypto.com and OKX contained the fallout on their platforms, while on-chain investigator ZachXBT assessed that North Korea’s Lazarus Group is likely not behind the incident.
Massive Coordinated Outflows Detected Across Major Crypto Exchanges
Between November 1 and November 2, blockchain intelligence firm Bitquery uncovered a series of coordinated, high-volume withdrawals totaling $108.8 million in USD Coin (USDC). The transactions originated from accounts hosted on three major cryptocurrency exchanges: Kraken, Crypto.com, and OKX. Following the unauthorized withdrawals, the actor systematically routed the capital through hundreds of secondary wallet addresses to obscure the transaction trail and reduce the likelihood of asset recovery.
To further protect the stolen funds from intervention by stablecoin issuers, the actor converted a significant portion of the USDC into Ether (ETH). Unlike centralized stablecoins like USDC, which can be blacklisted or frozen at the smart contract level by their issuing entities, native Ether transactions cannot be unilaterally halted or frozen by a centralized entity once settled on the Ethereum blockchain.
Exchange Responses and Account Mitigation Measures
In response to the suspicious capital flight, targeted centralized platforms activated emergency containment protocols. Crypto.com announced that it intervened to prevent funds linked to the exploit from being routed or transferred through its trading ecosystem. Concurrently, OKX disclosed that its security monitoring systems flagged unusual activity within a corporate client account. The exchange promptly froze the compromised account, established communication with the affected client, and confirmed that broader user accounts across the platform remained safe and unaffected.
Crypto.com echoed similar assurances regarding user safety, clarifying that retail and general platform balances were not impacted. Kraken did not issue an official statement or comment on the incident at the time the details were disclosed.
Attack Vector Unknown as On-Chain Analysts Assess Culprits
Security teams and blockchain forensics experts have yet to establish the exact attack vector used to breach the corporate and platform-level accounts. The mechanism granting the attacker access to the exchange accounts remains under investigation.
Despite the sophisticated dispersion of funds, prominent on-chain researcher ZachXBT weighed in on the laundering techniques observed in the breach. Based on the specific patterns and methodology used to move the assets, ZachXBT stated that they are highly confident that the North Korea-linked Lazarus Group is not responsible. However, this evaluation represents an independent forensic analysis by the researcher rather than an official finding by regulatory or law enforcement agencies.
Why This Matters
This multi-exchange incident highlights the persistent vulnerability of high-value corporate accounts within the digital asset ecosystem. While centralized stablecoins such as USDC provide issuers with the technical capability to freeze illicit funds, sophisticated attackers frequently exploit decentralized liquidity to convert assets into native cryptocurrencies like Ether, blunting the effectiveness of blacklists. The rapid responses from OKX and Crypto.com underscore the necessity of automated risk engines capable of isolating corporate account breaches before systemic liquidity is compromised.
Frequently Asked Questions
How much money was withdrawn during the incident?
According to blockchain analytics provider Bitquery, approximately $108.8 million worth of USDC was drained across accounts on Kraken, Crypto.com, and OKX over the course of November 1 and November 2.
Were general exchange users affected by the breach?
Both OKX and Crypto.com confirmed that broader user accounts remained secure. OKX specifically noted that the suspicious activity was isolated to a single corporate client account, which was frozen upon detection.
Is the Lazarus Group suspected of conducting the attack?
Independent on-chain sleuth ZachXBT indicated high confidence that North Korea’s Lazarus Group was not involved, citing the specific transaction mechanics and laundering methods utilized. However, the exact identity of the perpetrator and the attack vector remain undetermined.
