Onchain investigator ZachXBT now puts a suspected theft from an EU entity at more than $133 million, up from the more than $106 million in his first alert, after he traced another $27 million-plus in centralized exchange withdrawals by the same actor.

In the follow-up post on his Telegram channel, ZachXBT wrote that “a portion of the CEX withdrawals occurred after my initial disclosure.” He also listed four Ethereum addresses he tied to the theft.

He offered a first guess at the victim. His working theory, he wrote, is that “a large financial institution in Western Europe was exploited and it’s currently being covered up.” He did not name the institution or set out evidence for the cover-up claim in the post. As of publication, no institution, exchange or regulator had publicly confirmed or denied a loss.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

How the Loot Has Moved

In his original alert, ZachXBT said the funds left multiple exchange accounts on Nov. 1 as USDC and USDT, and that he was highly confident North Korea’s Lazarus Group was not behind it. Monero is where at least part of it ended up. He said the actor swapped USDC for ETH, passed funds through instant exchanges such as Kyrrex and WellWallet, then sent a portion into XMR using Wagyu.

The alerts follow the Oct. 29 drain of Binance’s hot wallets, which the FBI has since attributed to North Korea’s TraderTraitor.

Laundered Before a Freeze

ZachXBT in his most recent alert said that silence from the victim has cost money that could have been recovered. “No proper incident disclosure has resulted in $30M+ being laundered away which could have been frozen by EU law enforcement,” he wrote. He did not say which agencies, if any, have been contacted.

Why the Timing Matters

Issuers such as Tether and Circle can freeze USDT and USDC held at flagged addresses, and exchanges can hold deposits tied to a theft, but those tools depend on someone raising the alarm while the funds are still within reach. Each hop into ETH and then into Monero, which hides senders, receivers and amounts by default, shrinks what investigators and police can still stop.

Related Listen: Is THORChain a Money Laundering Service? A Chinese Crime Boss Says Yes