The $133M EU Crypto Theft Kept Growing After Someone Said It Out Loud

Someone walked off with about $133 million in crypto from a European operation, and $27 million of that total moved after the theft was already public.

The clock kept running

ZachXBT flagged the suspected theft first. Then he kept pulling on the thread. What he found was another $27 million in exchange withdrawals tied to the same trail, which pushed the running estimate from roughly $106 million up to about $133 million.

Read that again. The number grew after the warning.

Some of those withdrawals happened after he'd already told the world what he was looking at. That's not a rounding error or a slow block explorer. That's roughly a quarter of a nine-figure loss moving through exchange plumbing while the alarm bells were ringing in public.

The timeline matters more than the total. Day one, a suspected compromise gets flagged. Days after, addresses tied to the incident keep cashing out into exchange deposit addresses. ZachXBT keeps a public list, and the list keeps getting longer. Then comes the revised figure.

This is how these things usually go, and it's why the first number is almost never the last one. Investigators publish a floor, not a ceiling. The floor is what they can prove sits on known addresses. The ceiling is whatever the attacker already laundered through swap services, bridges, and peer-to-peer desks that don't ask questions. History says the ceiling is meaningfully higher than the floor. Ask anyone who tracked the big 2022 bridge exploits. The totals crept up for months.

And here's the part that should bother you. A guy with a public handle and a spreadsheet is doing the detection work in real time, out loud, for free. Meanwhile, the venues that actually touch the money are supposed to have compliance teams, transaction monitoring vendors, and risk budgets in the tens of millions.

So why did the pile keep growing?

Who eats the loss

Follow the cap table, then follow the runway. A hole this size doesn't land on the attacker's balance sheet. It lands on whoever got robbed, and the damage shows up in three places.

First, the victim's runway. Say the company raised a $40 million Series A and had 18 months of cash. A $133 million loss, if that's the full number and not a floor, is more than three times the raise. That's not a bad quarter. That's an existential event, because the money's gone and the revenue doesn't replace it next month. Burn rate tells you more than valuation, and a theft like this does something worse than burn rate. It resets the denominator.

Second, the exchanges. If $27 million slid through deposit addresses after a public flag, then either the screening didn't catch it, or it caught it and nobody moved fast enough to freeze. Both are bad. Crypto venues have spent years telling regulators their monitoring is institutional grade. A public researcher outrunning your compliance stack isn't a great look, and it's exactly the kind of thing that shows up in a licensing review.

The check writers are getting pickier about this, by the way. I've watched funds add security diligence to their pre-term-sheet checklist over the last two years. They ask about custody setup, key management, and whether the treasury sits in one hot wallet like it's 2019. Founders hate the questions. The questions are the reason some of them still have treasuries.

Third, the insurers and the LPs. Anything that touches digital asset coverage gets repriced after an event like this. Sources close to the deal say the specialty market for crypto custody and crime coverage is thin and getting thinner. Every nine-figure loss is an argument for higher premiums and tighter exclusions. And if you're an LP in a fund that held a position in the victim, you're about to learn how much of the loss is recoverable and how much is a write-down. My guess is the recoverable slice is small and slow.

The uncomfortable take here's that the industry treats exchange monitoring as a cost center right up until the moment it becomes the entire P&L. Then everyone wants to know why the freeze didn't happen in hour three instead of week two.

One more thing worth saying plainly. The attacker isn't a phantom. They need to convert. Every conversion is a checkpoint, and checkpoints are the only place this fight is actually winnable. Bridges, mixers, and no-KYC swaps exist, but they're not infinite, and the exits get narrower every time a researcher publishes a fresh address list.

What happens next

Watch the total, not the headline. If the estimate crosses $150 million, that tells you the trail is still opening up and the attacker is still converting. If it stalls near $133 million for a couple of weeks, the freezes probably caught something and the remaining funds are parked.

Watch for a stablecoin freeze. Issuers can blacklist addresses, and they've done it before. A confirmed blacklist on any major cluster would be the first real sign that the venue-side response has teeth.

Watch for an exchange confirmation. Not a vague statement about cooperating with law enforcement. An actual number. If a venue admits it processed part of this flow, expect a follow-up conversation about how that happened and who signed off on the risk controls.

And watch the disclosure. A victim with $133 million missing has a choice. Say nothing and hope the recovery works, or come clean and take the reputational hit plus the investor calls. In my experience, most pick silence for about two weeks and then get beaten to the story.

The honest read on this one is that the attacker may already be out, partially, into assets nobody can claw back. But the price of moving that money keeps going up, because the watching got faster and louder than the stealing. That's a thin win. It's still a win. The industry should probably stop treating the loud part as a bonus and start treating it as infrastructure, because right now the loudest compliance department in crypto is a solo researcher posting address strings at 2am.

If exchanges want to be taken seriously on security, they should publish freeze turnaround times the way they publish proof of reserves. Numbers, not adjectives. Until then, the estimate will keep climbing and the press releases will keep saying the same thing.