Kraken says the incident did not start on its platform and no customer accounts were taken over; Crypto.com says it has blocked related funds.

At a glance

  • Kraken said it has locked accounts that received funds from a suspected theft of more than $133 million at an unnamed EU entity, and that it is helping police try to recover the money.
  • The victim has not been identified, and the loss estimate comes from on-chain investigator ZachXBT, who raised it from $106 million on Tuesday.

Kraken has restricted the accounts through which part of a suspected $133 million-plus theft from an unnamed EU entity was moved, the exchange told Cointelegraph on Tuesday.

“This incident did not originate on the Kraken platform, and we’re actively investigating reports that some of the assets were subsequently moved through accounts on our platform,” Kraken said. “We’ve restricted the accounts in question and are working with law enforcement to support recovery efforts.”

Kraken added that its security systems were intact, that no customer account was hijacked and that its users face no continuing risk, according to Cointelegraph. The Defiant also reported the account restrictions.

How the estimate grew

ZachXBT put the suspected loss at $106 million on Monday, then added about $27 million in further exchange withdrawals on Tuesday, according to Cointelegraph. He said some withdrawals came after his first alert.

His working theory is that a large Western European financial institution was hit, Cointelegraph reported. That has not been confirmed, and no institution has come forward.

Data firm Bitquery traced withdrawals to accounts at Kraken, Crypto.com and OKX, and said about $62.98 million of stablecoins was swapped for 27,553 ETH in roughly four hours, Cointelegraph reported. Tether had frozen $1.1 million in USDT.

Where the money left

Most of the stablecoins left through Kraken, according to an on-chain review by Ledger Insights. Of $108 million in USDC moved on 1 and 2 Nov, it counted $102 million from Kraken accounts, $5.4 million from Crypto.com and $660,000 from OKX.

The outlet said the funds went out to 13 Kraken withdrawal addresses, one after another, across six hours on 1 Nov, with several getting a $1,000 test payment before the full balance. It found nothing on-chain pointing to a hack of Kraken itself.

Crypto.com said it had “taken appropriate action to block any funds associated with this third-party incident”, according to Cointelegraph. OKX said it was looking into the matter.

Context

Kraken’s parent Payward agreed on 15 Oct to buy a Lithuanian lender to gain an EU banking licence, as CryptoWatchDesk reported when Kraken’s parent agreed to buy Lithuania’s Saldo Bank. The theft report comes days after Binance’s own account of its hack and Brazil’s Mercado Bitcoin’s wallets were drained.

The victim has not been named, and Kraken said its work with law enforcement on recovery is continuing.

Get the week’s raises and deals in The Ledger Weekly.

This article is for information only and is not investment advice.