TL;DR
- Approximately $108.8 million in USDC left accounts at Kraken, OKX, and Crypto.com between November 1 and 2.
- Eleven of the 15 receiving wallets had previously received payments from the same exchanges, raising questions about compromised credentials and private keys.
- Attackers converted $62.98 million in stablecoins into 27,553 ETH, leaving only $3.7 million in USDC potentially subject to freezing by Circle.
A suspected $108.8 million crypto theft has exposed potential weaknesses in exchange account security and wallet management after funds moved through previously used withdrawal addresses. An investigation by blockchain analytics firm Bitquery traced the transactions across Ethereum, identifying patterns that suggest the attackers may have accessed both exchange credentials and private keys.
The incident involved accounts at Kraken, OKX, and Crypto.com, with investigators examining how the funds moved and which security mechanisms could have prevented the withdrawals.
Crypto Heist Used Previously Approved Wallet Addresses
The first withdrawals occurred on November 1, beginning with OKX at 12:25 UTC, followed by Kraken 44 minutes later. Crypto.com also processed part of the transfers, although Kraken accounted for approximately 95% of the total amount identified by Bitquery.
Around $73.2 million left the exchange accounts within three hours, while the final identified withdrawal arrived the following morning. One receiving address collected 43 Kraken transactions over 91 minutes, each worth less than $50,000. Investigators believe this pattern could indicate an attempt to bypass individual withdrawal limits.
The most relevant finding involved the destination wallets. Eleven of the 15 addresses had previously received payments from the same exchanges, accounting for 84% of the transferred funds.
This history complicates the traditional security model based on approved withdrawal addresses. Even when an exchange recognizes a destination as legitimate, that protection becomes less effective if an attacker already controls the corresponding wallet keys.
Bitquery also identified eight Trust Wallet smart accounts among the receiving addresses. However, its investigation found no evidence that a vulnerability in Trust Wallet itself caused the incident.
Stablecoin Conversions Reduced Recovery Options
After receiving the funds, the suspected attackers moved quickly to exchange assets. Through UniswapX, they converted approximately $62.98 million in USDC and USDT into 27,553 ETH, at an average price near $2,286 per coin.
The distinction matters because USDC remains subject to freezing by its issuer, Circle, while ETH has no centralized issuer capable of freezing individual balances. Additional funds moved into DAI, which also lacks a comparable freeze mechanism.
By November 2, approximately $78.27 million remained in addresses associated with the suspected attackers. This included $68.9 million in ETH, $5.6 million in DAI, and $3.7 million in USDC.
