Kraken Restricts Accounts as Suspected EU Crypto Theft Tops $133 Million
By Crypto Wire
November 3, 2026
Kraken told Cointelegraph on November 3, 2026 that it has restricted accounts linked to a suspected crypto theft of more than $133 million from an unidentified European Union entity and is working with law enforcement on recovery. The exchange said the incident did not originate on its platform, that its security systems and customer accounts were not compromised, and that there is no ongoing risk to its customers. Crypto.com separately said it blocked funds tied to the third-party incident from moving through its platform, while OKX said it was looking into the matter. The desk is reading this as a custody-and-disclosure beat — not a Kraken breach print.
The updated dollar figure comes from on-chain investigator ZachXBT, who said on Tuesday that he identified another $27 million in withdrawals from centralized exchanges after an initial Monday estimate above $106 million. Some of those later withdrawals, he said, occurred after his first public disclosure. Bitquery reporting cited in the same Cointelegraph update said suspected stolen funds were withdrawn from accounts at Kraken, Crypto.com, and OKX, and that about $62.98 million in stablecoins was converted into roughly 27,553 ETH within about four hours.
As of 13:47 UTC Monday, Bitquery figures carried in the wrap put about $78.3 million still in wallets linked to the suspected attacker and about $30.5 million already moved out of the tracked set. Only about $3.74 million remained in USDC that Circle might still freeze, while Tether had already frozen about $1.1 million in USDT. Those tape marks matter for NFT and crypto settlement desks because freezable stablecoin legs shrink fast once eth and Monero rails open — the same pattern collectors watch whenever an exchange pause hits marketplace cash.
Kraken’s statement to Cointelegraph was explicit on the legal posture: “This incident did not originate on the Kraken platform, and we’re actively investigating reports that some of the assets were subsequently moved through accounts on our platform. We’ve restricted the accounts in question and are working with law enforcement to support recovery efforts.” Crypto.com’s spokesperson said the firm had “taken appropriate action to block any funds associated with this third-party incident,” adding that its platform remained fully operational and that user funds were secure and accessible. Those are company claims about account controls and recovery cooperation — not a court finding that names the victim or adjudicates the theft.
ZachXBT’s working theory, posted on his Telegram channel and relayed in the same reporting, is that a large financial institution in Western Europe was exploited and that the incident is being covered up. He also argued that the lack of a proper incident disclosure allowed more than $30 million to be laundered and that earlier EU law-enforcement freezes might otherwise have been possible. The victim’s identity and any cover-up allegation remain unverified. Separately, ZachXBT said the laundering pattern — swaps into ETH and Monero (XMR) through instant exchanges and cross-chain bridges — did not match methods typically associated with North Korea’s Lazarus Group. Treat that as investigator commentary, not a forensic verdict.
For collectors and marketplace operators, the actionable policy signal is narrower than the headline dollar print. Major CEXs are already treating linked deposit and withdrawal accounts as restrictable once an external theft cluster is flagged, even when the exchanges say their own systems were not breached. That is the compliance move that can stall NFT settlement cash, OTC NFT bids, and stablecoin top-ups when addresses touch a watched cluster — regardless of whether the original victim ever files a public incident notice.
What changes for bids: Until a named EU victim, a prosecutor filing, or a dated recovery total lands, the live rule for traders is exchange-side account restriction and issuer freezes on the remaining freezable stables — not a new statute. Watch whether Kraken, Crypto.com, or OKX publish a recovery figure, whether Circle freezes more of the residual USDC, and whether any European authority confirms the victim. Those primary moves are what next change custody screening for NFT marketplace cash legs.
Bottom line: ZachXBT’s revised $133 million EU-entity theft print triggered same-day account restrictions at Kraken and fund blocks at Crypto.com, with OKX still investigating — while the victim remains unnamed and exchange customers are told their platforms were not breached.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
