Kraken Restricts Accounts Amid Suspected $133 Million EU Crypto Theft

Published November 3, 2026, 8:30 PM PKT. Based on Kraken's statement to CoinTelegraph (primary source), blockchain analytics firm Bitquery's November 3, 2026 investigation (primary source), CoinTelegraph's November 3, 2026 report (secondary source), and blockchain investigator ZachXBT's Telegram updates (primary investigator source, as reported by CoinTelegraph and Bitquery). This is a standalone story, the first MABOnChain article on this incident.

Kraken has restricted accounts linked to a suspected crypto theft of more than $133 million from an unidentified European Union entity and is working with law enforcement to support recovery efforts, the exchange told CoinTelegraph on November 3, 2026. "This incident did not originate on the Kraken platform, and we're actively investigating reports that some of the assets were subsequently moved through accounts on our platform," Kraken told CoinTelegraph. "We've restricted the accounts in question and are working with law enforcement to support recovery efforts." Kraken said its security systems had not been compromised, no customer accounts had been taken over, and there was no ongoing risk to its customers. Crypto.com told CoinTelegraph it had taken action to block funds associated with the incident from moving through its platform, saying its platform remains fully operational and all user funds are secure and accessible. OKX acknowledged CoinTelegraph's request for comment and said it was looking into the matter.

From $106 million to more than $133 million

The exchange actions follow blockchain investigator ZachXBT's disclosure on Tuesday, November 3, that he had identified another $27 million in withdrawals from centralized exchanges, raising the suspected losses from the $106 million he reported on Monday, November 2. He said some withdrawals occurred after his initial disclosure. "My working theory is a large financial institution in Western Europe was exploited and it's currently being covered up," ZachXBT said on his Telegram channel, adding that the lack of a proper incident disclosure allowed more than $30 million to be laundered, when he argued EU law enforcement could otherwise have frozen the funds. The victim's identity and the cover-up allegation remain unverified, and no victim, company, or law enforcement agency has publicly confirmed the theft. ZachXBT said earlier that the attacker was swapping funds into ETH and Monero through instant exchanges and cross-chain bridges, and that the laundering patterns did not match those typically used by North Korea's Lazarus Group.

How $108.8 million left three exchanges in 21 hours

Bitquery, which followed the money on Ethereum from the addresses ZachXBT listed and back to where it came from, counted $108.80 million in USDC withdrawn from accounts at Kraken, Crypto.com and OKX to 15 wallets on November 1 and 2, four wallets more than the posted list of 11 named. Kraken paid 95% of the total across 178 withdrawals, Bitquery found. The first withdrawal left OKX at 12:25 UTC on Sunday, November 1, Kraken followed 44 minutes later, and withdrawals built through the afternoon and peaked in the evening: $73.2 million left in the three hours to 23:00 UTC, 98% was gone by 23:10 UTC, and the final payment landed at 09:09 UTC on November 2. Eleven of the 15 wallets had been paid by the same exchanges before the theft, two of them since May, and they took 84% of the money, which Bitquery said makes them look like the victim's own wallets. One new wallet took 43 Kraken withdrawals in 91 minutes, each under $50,000, a pattern Bitquery said looks like the thief working around a per-withdrawal limit. Because the thief likely held both the exchange logins and the keys to wallets the victim had used before, Bitquery said the evidence points to a break-in on the owner's own devices or wallet setup, or to someone inside the victim's own team, while noting that the chain alone cannot tell those apart. Many exchange accounts can lock withdrawals to a short list of approved addresses, called an allowlist, and Bitquery noted that if the accounts used one, the thief was able to add to it, while if they had none, the thief could send money anywhere.

The four-hour swap into 27,553 ETH

The thief's first job after the withdrawals was to swap out of freezable stablecoins, Bitquery said, because Circle, the company behind USDC, can freeze coins at any address, while ETH has no such switch. Just before midnight UTC, a fresh wallet started selling stablecoins through UniswapX, an auction where market makers compete to fill orders, and within about four hours it had sold $62.98 million of USDC and USDT for 27,553 ETH, about $2,286 per ETH, between 23:44 UTC on Sunday and 04:02 UTC on Monday. Another branch of the theft swapped its USDC into DAI instead, a stablecoin with no freeze function. Circle did not freeze any of the thief's USDC during the sale, or by Bitquery's check on Tuesday, and Bitquery said it does not know whether anyone asked Circle to act. The contrast with the previous week is stark: after the Binance hack, Tether and Circle froze more than $2 billion within hours, Bitquery noted, while here the swap ran for four hours with no freeze at all.

Where the money stands now

More than half of the traced money was still on Ethereum at Bitquery's Tuesday afternoon snapshot. At 13:27 UTC on November 3, $61.00 million sat in addresses tied to the thief, mostly as ETH, while about $50.3 million had left those addresses, net of anything sent back. The thief sped up on Tuesday: from morning to early afternoon UTC, about $11 million left the thief's wallets, more than the $9 million in the 19 hours before, and most of it went to bridges, Bitquery said. The largest exits to 13:27 UTC were LI.FI, a bridge and swap router, at $8.70 million, a KuCoin deposit address at $8.12 million that Bitquery said is likely the pooled account of Kyrrex, a European exchange, based on TRM's graph tags, FixedFloat, an instant exchange that needs no account, at $3.84 million, and a swap-and-bridge router that moved $3.56 million of USDT off Ethereum via LayerZero's USDT0. Bybit and MEXC took $1.4 million between them, and another $15.28 million went to addresses with no label, several of which swap and pay out like over-the-counter desks. The biggest single pile, 4,055 ETH, sat in the wallet whose USDT Tether froze. On Tuesday morning, 396 ETH arrived at a Kraken deposit address from that same wallet through two fresh wallets and was swept into a Kraken hot wallet three minutes later, Bitquery said, giving Kraken a way to act, since the deposit address belongs to an existing Kraken account and Kraken can see whose account it credited, though Bitquery said it cannot tell whether it belongs to the thief, a helper, or a service the thief paid.

What the freezes have and have not caught

Tether made the only issuer freeze so far. On Monday afternoon the thief swapped 500 ETH into 1.14 million USDT and moved it to a fresh wallet that evening, and Tether froze it at 23:10 UTC on November 2, Bitquery said. Four minutes earlier, the thief had sent 4,450 ETH to the same wallet, and that ETH is still free to move. Circle has frozen none of the 2.53 million USDC that sat in the thief's wallets on Tuesday, nearly all of it in two wallets, and that USDC remains freezable. Most of what the thief holds cannot be frozen by an issuer at all: ETH has no issuer, and DAI has no freeze function. Kraken has not disclosed how many accounts it restricted or the value of assets involved, so the amount available for recovery through the exchange action is unclear.

What remains unverified

The central fact of this story is still unconfirmed by any victim or authority. Bitquery said it could not name the victim: none of the 15 addresses appears in its address labels, none has an ENS name or a readable wallet name, and no public post it found ties them to a company. The Kyrrex connection is loosely held: the owner used Kraken since May, Crypto.com since October and OKX as well, and between October 20 and November 1, two of the 15 wallets paid deposit addresses of a service that TRM's graph tags as Kyrrex, so the owner likely had an account there too, Bitquery said, while stressing that the chain cannot confirm ZachXBT's large-institution theory either way. Kraken, which paid 178 of the withdrawals, can say for sure who owns the account, Bitquery noted, but it has not named them. Readers should therefore treat the $133 million figure as a suspected theft total assembled by an independent investigator and partly corroborated by on-chain tracing, not as a confirmed loss announced by a victim, and should treat the cover-up claim as an unverified allegation. What is confirmed is narrower but significant: three major exchanges were used to move the funds, two of them have now acted publicly to restrict or block associated accounts, and $61 million remained traceable on Ethereum as of Tuesday afternoon. This article is news reporting and is not investment advice.

Sources

• Kraken, statement to CoinTelegraph (November 3, 2026, primary source: restricted the accounts in question, working with law enforcement to support recovery efforts, incident did not originate on the Kraken platform, security systems not compromised, no customer accounts taken over, no ongoing risk to customers)
• Bitquery, $106M Crypto Hack: $108.8M Traced, $61.0M Still on Ethereum (November 3, 2026, primary source: $108.80 million in USDC from Kraken, Crypto.com and OKX to 15 wallets over about 21 hours on November 1 and 2, Kraken paid 95% across 178 withdrawals, $62.98 million swapped into 27,553 ETH in about four hours, $61.00 million still on Ethereum at 13:27 UTC on November 3, Tether froze 1.14 million USDT, Circle froze none of 2.53 million USDC, 396 ETH to a Kraken deposit address on November 3)
• CoinTelegraph, Kraken Restricts Accounts Amid Suspected $133M EU Crypto Theft (November 3, 2026, secondary source: Kraken, Crypto.com and OKX responses, ZachXBT's rise from $106 million to more than $133 million, $78.3 million remaining in tracked wallets and $30.5 million moved out as of 13:47 UTC Monday, victim identity and cover-up allegation unverified)
• ZachXBT, Telegram updates (November 3, 2026, primary investigator source, as reported by CoinTelegraph and Bitquery: additional $27 million in exchange withdrawals identified Tuesday, some after the initial disclosure, working theory of a large Western European financial institution exploited and covered up, attacker swapping into ETH and Monero through instant exchanges and bridges, laundering patterns not matching Lazarus Group)
• The Defiant, Kraken Restricts Accounts Amid Suspected $133 Million-Plus EU Theft (November 3, 2026, secondary source: corroborates Kraken's account restrictions and law enforcement cooperation, exchange systems and customer accounts not compromised)