Two major crypto security incidents in the span of days. One household name already burned. Now an unnamed European institution is nursing a wound that exceeds $106 million — and nobody yet knows who they are. The string of high-value thefts targeting centralized exchange infrastructure is beginning to look less like coincidence and more like a systematic reckoning with the industry's persistent custody vulnerabilities.
According to ZachXBT, the pseudonymous onchain investigator whose blockchain forensics work has become indispensable to the crypto security community, an unidentified entity based in the European Union lost more than $106 million from centralized exchange accounts on Sunday, November 1, 2026. The disclosure arrived days after a separate high-profile breach struck Binance, placing back-to-back exchange-related thefts in uncomfortable proximity and raising urgent questions about the security posture of institutional players across the sector.
Details on the EU entity remain sparse by design or by necessity — ZachXBT has not publicly identified the victim, a common practice when investigations are active and disclosure could compromise recovery efforts or tip off perpetrators moving funds through mixers and cross-chain bridges. What is known is that the losses were drawn from centralized exchange accounts, not from a self-custodied wallet or a decentralized protocol. That distinction matters enormously. Centralized exchanges represent a single point of failure: if account credentials, API keys, or internal systems are compromised, the attacker inherits the full balance without needing to crack any cryptographic primitive.
The timing relative to the Binance incident deserves scrutiny. Whether the two events are linked — sharing infrastructure, attackers, or methodology — remains an open question. Security researchers tend to caution against assuming connection simply because events cluster temporally. Opportunistic attacks sometimes spike after a major breach simply because the publicity attracts other threat actors looking to capitalize on distracted teams and rattled institutions. Alternatively, a coordinated campaign targeting European and global exchange infrastructure simultaneously would represent a qualitatively different threat: organized, well-resourced, and strategically patient.
For the EU regulatory environment specifically, this theft lands at a delicate moment. The Markets in Crypto-Assets regulation, known as MiCA, has been progressively reshaping how crypto service providers operate across member states, with tightened requirements around custody, capital buffers, and consumer protection. If the victimized entity turns out to be a licensed or soon-to-be-licensed crypto asset service provider operating under MiCA's framework, regulators will face pointed questions about whether compliance mandates have translated into actual operational security — or merely paperwork. A $106 million loss from centralized exchange accounts suggests, at minimum, that some part of the access control chain failed catastrophically.
ZachXBT's role in surfacing this incident reflects a broader structural gap in crypto's security architecture. In traditional finance, regulators, clearinghouses, and established fraud detection networks create overlapping alert systems that can flag anomalous activity within minutes. In crypto, much of that early-warning function has been informally delegated to a small number of independent onchain investigators who monitor blockchain activity without institutional backing. ZachXBT has repeatedly been the first to publicly document major thefts, often before the victims themselves have issued any statement. That this $106 million loss became public knowledge through a single investigator rather than through any formal disclosure mechanism underscores how immature the sector's incident response infrastructure remains — even as the asset values at risk have grown into the tens and hundreds of millions.
The centralized exchange vector is worth dwelling on. The narrative around crypto security has evolved considerably over the past several years, with much industry effort directed toward educating users about self-custody, hardware wallets, and the risks of leaving assets on exchanges. Yet institutional actors — funds, family offices, corporate treasuries, and licensed intermediaries — often have operational reasons to maintain large balances on exchanges: liquidity management, active trading mandates, or the need to move capital quickly across markets. Those operational requirements create exposure that no amount of user education fully resolves. The answer for institutions has to be structural: multi-signature authorization, withdrawal whitelists, hardware security modules, and real-time anomaly detection baked into exchange partnerships rather than bolted on afterward.
Whether the $106 million stolen from this EU entity is recoverable depends on how quickly investigators can track fund movements and whether exchanges receiving those funds act on freeze requests. The window for recovery narrows fast once assets hit privacy tools or cross into jurisdictions with limited cooperation frameworks. ZachXBT's early disclosure creates at least a chance that the broader security community can assist in tracing — but with an unidentified victim and an unnamed attacker, the public record remains frustratingly thin.
What this incident makes undeniable is that centralized exchange accounts at institutional scale are a high-value target that attackers are actively pursuing, and that two significant breaches within days of each other is not a statistical anomaly to be explained away. The industry needs to treat this cluster as a signal, not noise.
Written by the editorial team — independent journalism powered by Bitcoin News.