$133M Stolen, and the Thief Kept Cashing Out After ZachXBT Caught Them
The suspected thief didn't stop. Even after on-chain investigator ZachXBT publicly flagged the theft, an additional $27 million in exchange withdrawals kept moving — bringing the total estimated haul to $133 million.
That detail should alarm every crypto holder more than the number itself.
What Actually Happened
ZachXBT, the pseudonymous blockchain detective responsible for exposing some of crypto's largest hacks and scams, initially identified a major suspected theft tied to a European Union-based target. The figure was already staggering. But after he published his findings, the withdrawals didn't freeze. They continued.
That $27 million in additional outflows happened after the public warning was live. Either the actor had already pre-staged the exits and couldn't be stopped, or they were bold enough to keep moving funds knowing the entire crypto community was watching.
Neither explanation is comforting.
Why This Pattern Is Becoming a Problem
This isn't the first time ZachXBT has flagged an active theft only to watch funds continue moving. The window between detection and actual asset recovery, or freezing, remains dangerously wide across most exchanges.
When $27 million can exit after a public flag, it raises an uncomfortable question: what are exchanges actually doing with on-chain intelligence in real time?
The EU has been positioning itself as the world's most crypto-regulated region, with MiCA now in effect. But regulation governing disclosures and licensing doesn't automatically translate into rapid response infrastructure when funds are actively being drained.
The Number That Should Worry You
$133 million is not a rounding error. This is one of the larger suspected thefts tracked in recent months, and the post-flag withdrawals suggest the perpetrator had significant pre-planning, multiple exchange accounts, or both.
The methodology here matters. ZachXBT traced the funds through exchange withdrawal patterns, not just wallet clustering. That means someone was actively converting and moving through centralized off-ramps, the same ones most retail holders use every day.
What to Watch
If you hold funds on any EU-facing exchange or recently received a large inbound transfer from an unknown counterparty, now is the time to review your withdrawal history and enable every available security layer.
Watch for ZachXBT's follow-up threads closely. He has a track record of naming specific platforms once the investigation matures. The exchanges connected to these withdrawals will face serious questions, and if any are publicly traded or MiCA-licensed, the regulatory fallout could move markets fast.
The theft is big. The timing is bigger. Stay close to this one.