A crypto theft of rare magnitude has just shaken the industry. More than $133 million is believed to have been stolen from an unidentified European entity, according to blockchain investigator ZachXBT. Kraken, Crypto.com, and OKX moved quickly to try to contain the damage.

But behind the exchanges’ swift response lies a darker reality: more than $30 million had already been laundered before the platforms stepped in. The question of disclosure timing is now at the heart of the criticism.

Here is a breakdown of an incident that illustrates, once again, the race against the clock that defines major security incident response in the crypto ecosystem.

$133 Million Stolen: What We Know About the Incident

It was ZachXBT who first raised the alarm on November 2, estimating initial losses at over $106 million. The very next day, on November 3, he published an update raising the total estimate to $133 million, after tracing an additional $27 million in withdrawals across centralized exchanges — some of which occurred after his first public disclosure.

According to the investigator, the victim is believed to be a large financial institution based in Western Europe. He also raised the possibility that the incident is being deliberately concealed — an allegation that has not yet been independently verified. The identity of the compromised entity remains unknown at this stage.

Blockchain analytics firm Bitquery confirmed that the suspected stolen funds moved through accounts opened on Kraken, Crypto.com, and OKX. Its analysis also revealed that approximately $62.98 million in stablecoins were converted into 27,553 ETH within just four hours — a classic maneuver used to obscure the trail.

How the Attacker Attempted to Disappear the Funds

The modus operandi described by ZachXBT follows a well-established pattern seen in major crypto hacks. The funds moved through the Ethereum network, instant swap services, and cross-chain bridges, making the tracing process particularly complex. A portion of the assets was also converted into Monero (XMR), the go-to privacy coin for anonymizing transactions.

At the time of Bitquery‘s snapshot, taken at 13:47 UTC on November 2, approximately $78.3 million remained in wallets associated with the suspected attacker, while $30.5 million had already left the tracked addresses. The window for stablecoin issuers to act was extremely narrow: only $3.74 million in USDC remained potentially freezable by Circle, and Tether had already frozen $1.1 million in USDT.

ZachXBT is unequivocal: the failure to disclose the incident promptly allowed more than $30 million to be laundered when it could have been blocked in time. This finding points directly to the responsibility of the victim entity in its handling of the crisis.

The Exchange Response: Fast — But Was It Enough?

Kraken confirmed that it has restricted accounts linked to the incident and is actively cooperating with law enforcement in an effort to recover the funds. The exchange was keen to clarify that the vulnerability did not originate from its platform and that its security systems and customer accounts were not compromised.

Crypto.com also confirmed that it has frozen funds associated with the third-party incident, while OKX stated that it is currently reviewing the situation. These coordinated responses reflect improved cross-platform cooperation — but they came only after tens of millions of dollars had already changed hands.

The case raises a structural question: in an ecosystem where transactions are irreversible and bridges operate near-instantly, exchange response time remains the weakest link when facing organized attackers. The investigation is still ongoing, and the identity of the victim has yet to be revealed.