Key Highlights:
- Blockchain analytics firm Bitquery detected $108.8 million in USDC drained from Kraken, Crypto.com, and OKX accounts across a 21-hour window on November 1 and 2.
- Perpetrators routed the stolen assets through hundreds of intermediary wallets, converting significant portions into ether (ETH) to prevent centralized blacklisting.
- Crypto.com confirmed it blocked connected transactions, assuring users their assets remain safe, while Kraken and OKX did not immediately respond to inquiries.
Massive Digital Asset Outflow Detected Across Major Exchanges
In a sophisticated, multi-stage withdrawal campaign, unauthorized actors managed to extract $108.8 million in USD Coin (USDC) from accounts hosted on major cryptocurrency exchanges, including Kraken, Crypto.com, and OKX. The systematic asset drain occurred over a continuous 21-hour window spanning November 1 and November 2, exposing centralized trading platforms to intense scrutiny over transaction monitoring and fund security protocols.
According to findings published by blockchain analytics firm Bitquery, the illicit funds were routed through an intricate web of hundreds of digital wallets to obscure transaction origins. To evade immediate blacklisting measures available to stablecoin issuers, the perpetrators converted large portions of the stolen USDC into ether (ETH). Unlike centralized stablecoins, which feature programmatic freezing capabilities embedded into their smart contracts, decentralized ether cannot be unilaterally frozen by a centralized entity.
Exchange Responses and On-Chain Investigation
Tracking efforts conducted by Bitquery also documented an inbound transfer of 396 ETH into a Kraken deposit address. However, the analytics firm noted it could not determine whether Kraken had successfully frozen those specific assets or confirm the true identity of the entity controlling the receiving account. While Kraken and OKX did not immediately reply to requests for comment submitted by CoinDesk, Crypto.com acknowledged the security event and reported taking decisive containment actions.
Addressing the movement of compromised capital, a Crypto.com spokesperson stated, We are aware of this report and have taken action to block funds linked to the incident from moving through Crypto.com. All user funds remain secure and accessible,
underscoring that their internal customer balances remained insulated from the breach.
Regulatory Moves Amid Broader Cybersecurity Pressures
The unauthorized withdrawals surface at a sensitive time for traditional financial institutions expanding into digital asset infrastructure. Traditional banking players have been actively preparing to launch digital currency ventures; in May, French financial publication L’Agefi reported that a bank had formally applied for authorization under the European Union’s Markets in Crypto-Assets (MiCA) regulatory framework to supply crypto offerings to retail clients and institutional counterparties.
This incident adds to an ongoing cycle of high-profile cyber intrusions against the digital asset sector. Recent cybersecurity compromises include breaches impacting BTCPay Server and Brazilian exchange Mercado Bitcoin, alongside the massive $6.3 billion Binance incident that the Federal Bureau of Investigation (FBI) linked directly to state-sponsored North Korean hacking groups.
Why This Matters
The conversion of tens of millions of dollars from centralized stablecoins into non-custodial digital assets illustrates how exploiters continually adapt laundering routes to outmaneuver centralized compliance controls. Because regulated stablecoin operators retain the ability to halt wallet addresses, attackers increasingly treat asset conversion into native blockchain tokens like ether as a necessary step in evasion tactics. As institutional banks prepare to roll out consumer-facing crypto services under EU MiCA compliance, exchange vulnerabilities and cross-platform money-laundering vectors remain primary operational risks that regulators and security providers must solve.
Frequently Asked Questions
How much money was involved in the unauthorized transfer?
According to the on-chain analysis by Bitquery, approximately $108.8 million in USDC was withdrawn from Kraken, Crypto.com, and OKX over a 21-hour period between November 1 and November 2.
Why did the attackers convert USDC into ether?
Centralized stablecoin issuers retain the technical capability to freeze USDC addresses linked to illicit activities. In contrast, ether (ETH) operates natively on Ethereum without a central issuer capable of remotely halting token transactions, making it significantly harder for authorities to intercept.
Were Crypto.com user funds compromised during the incident?
No. A Crypto.com spokesperson confirmed that user funds remained safe and fully accessible, stating that the platform had successfully blocked assets linked to the incident from flowing through its systems.
