Two separate theft incidents flagged by on-chain investigators within the same reporting window have sent another sobering signal through the digital asset industry: large-scale crypto theft is not slowing down, and no architecture — centralized exchange accounts or decentralized arbitrage infrastructure — is fully immune. A European entity is suspected of losing $106 million from exchange accounts, while a wallet tied to a Solana arbitrage bot appears to have been drained of approximately $786,000 in a separate incident.
The figures represent two distinct attack surfaces and two very different victim profiles, but together they underscore a pattern that crypto security researchers have been documenting with grim regularity: sophisticated actors are targeting both institutional-scale custodial positions and automated on-chain infrastructure at the same time, often exploiting entirely different classes of vulnerability to do so.
The $106 Million Exchange Account Incident
The larger of the two incidents involves a European entity — the precise nature of which has not been fully disclosed — that investigators suspect lost $106 million directly from exchange accounts. The scale of the loss places it firmly among the more significant thefts recorded in the space this cycle. Exchange account compromises at this magnitude typically involve some combination of credential theft, compromised application programming interfaces, or insider access, though the specific vector in this case had not been publicly confirmed at the time of reporting.
On-chain investigator ZachXBT, who has become one of the most closely followed figures in crypto forensics, flagged the suspected theft. ZachXBT has built a track record of identifying stolen funds, tracing wallet activity, and surfacing theft patterns before law enforcement agencies have formally acknowledged incidents — a dynamic that speaks both to the transparency of public blockchains and to the persistent lag between on-chain evidence and institutional response.
A $106 million loss from exchange accounts raises immediate questions about the risk controls in place for entities holding or managing assets at that scale. Institutional and semi-institutional actors operating in European jurisdictions are increasingly subject to regulatory frameworks — including the Markets in Crypto-Assets, or MiCA, regulation — that carry expectations around custody standards, operational security, and incident disclosure. Whether this incident triggers any formal regulatory scrutiny will depend heavily on the nature of the entity involved and which jurisdiction's rules apply.
The Solana Arbitrage Bot Drain
The second incident is smaller in absolute dollar terms but arguably more technically interesting. A wallet associated with a Solana arbitrage bot is suspected of having been drained of roughly $786,000. Arbitrage bots operating on Solana are a fixture of the network's decentralized finance, or DeFi, ecosystem — they exploit price discrepancies across liquidity pools and decentralized exchanges to generate profit, often executing hundreds of transactions per second given Solana's high-throughput architecture.
The suspected drain of such a wallet could point to a range of attack vectors: a compromised private key, a vulnerability in the bot's smart contract logic, a sandwich attack that went catastrophically wrong, or a malicious upgrade to a program the bot interacted with. The specifics matter enormously for the broader Solana developer community, as arbitrage infrastructure is deeply embedded in how the network's DeFi markets maintain price efficiency.
Solana has attracted significant developer activity and liquidity precisely because of its speed and low transaction costs. That same throughput that makes the chain attractive for automated market-making strategies also means that a malicious actor who gains access to an active bot wallet can move funds out faster than most human operators can respond. At $786,000, this incident may not register as catastrophic in isolation, but the operational lessons apply to a much larger pool of capital running similar automated strategies on the network.
What This Means for the Industry
Taken together, these two incidents illustrate a threat landscape that does not discriminate by architecture. The $106 million loss targets the custodial layer — the exchange account infrastructure that institutional and professional participants rely on. The $786,000 Solana bot drain targets the programmatic layer — the automated, on-chain systems that have become load-bearing infrastructure for DeFi liquidity. Both layers have known attack surfaces that the industry has not yet systematically closed.
For security teams, compliance officers, and investors operating in this space, the dual nature of these incidents is the real story. Hardening exchange account security through multi-signature authorization, withdrawal whitelists, and rigorous application programming interface key management addresses one risk surface. Auditing smart contract logic, securing bot wallet private keys in hardware security modules, and monitoring on-chain activity in real time addresses another. Neither approach substitutes for the other, and the cost of neglecting either — as these two suspected incidents demonstrate — can be measured in the tens of millions.
ZachXBT's continued role in surfacing these incidents before formal disclosures arrive also points to an enduring structural gap: the crypto industry's public forensic infrastructure, built largely by independent researchers, is often faster and more transparent than the institutional and regulatory machinery meant to protect market participants. That gap is narrowing, but November 2026 offered another reminder that it has not closed.
Written by the editorial team — independent journalism powered by Bitcoin News.