Kraken and Crypto.com Move to Contain Suspected $133 Million European Crypto Theft

Cryptocurrency exchanges Kraken and Crypto.com have moved swiftly to halt the movement of stolen capital following an illicit transfer of more than $133 million from a suspected European organization. Both trading platforms confirmed they have taken targeted enforcement steps, including freezing specific recipient accounts and intercepting transactions connected to the stolen assets.

Kraken confirmed that its core trading infrastructure and customer balances were not compromised in the security breach. The exchange clarified that the exploit did not originate within its platform, but it placed restrictions on targeted accounts after on-chain data indicated that portions of the drained funds were routed through its deposit rails.

Crypto.com disclosed that it also executed preventative measures to intercept and block transactions tied to the suspected incident. The platform maintained that its operational environment remains secure, with customer funds unaffected, while its risk and security teams coordinate responses to blacklisted recipient addresses.

The scale of the incident came to public attention through blockchain sleuth ZachXBT, who initially reported a $106 million security failure before revising the suspected loss upward to surpass $133 million. On-chain tracing revealed that the compromised organization appears to be a major entity in Western Europe, though the victim has yet to publicly acknowledge the intrusion.

According to investigative disclosures, the lack of immediate public disclosure by the targeted entity provided the attacker with a critical operational window. Sleuths pointed out that the perpetrator continued to launder tens of millions of dollars uninterrupted even after initial blockchain anomalies were cataloged, pointing toward an alleged attempt to manage the breach without public transparency.

Blockchain transaction records compiled by tracking specialists show that the attacker largely siphoned dollar-pegged stablecoins, primarily USD Coin and Tether, across multiple centralized venues. To obfuscate the provenance of the assets, the perpetrator quickly traded large volumes of stablecoins into Ether across decentralized exchanges before asset issuers could intervene.

Following the conversion into Ether, the stolen capital was systematically channeled through automated instant swaps, cross-chain communication bridges, and privacy-focused cryptocurrencies including Monero. Security researchers noted that these complex routing paths are designed to break transaction trails, distinguishing the operation from patterns typically observed in state-sponsored cyber syndicates.

While asset issuers such as Circle and Tether maintain the capability to freeze targeted stablecoin smart contracts on public chains, the rapid transition into Ether and non-custodial bridges severely narrowed recovery opportunities. Consequently, only a modest fraction of the initial sum has been immobilized by centralized stablecoin administrators before disappearing into decentralized liquidity pools.

The episode highlights the ongoing vulnerability of institutional digital asset custodians and the persistent friction between centralized compliance controls and permissionless decentralized networks. As security researchers and exchange compliance desks share real-time telemetry, law enforcement authorities across Europe are expected to intensify scrutiny surrounding institutional reporting obligations for catastrophic cybersecurity failures.