Suspected $108.8M Heist Moved Through Wallets Exchanges Already Trusted

A blockchain investigation has traced a suspected $108.8 million crypto theft through wallets the exchanges already trusted. According to crypto-economy.com, analytics firm Bitquery followed the money across Ethereum and found that 11 of the 15 destination addresses had previously received payments from the very same exchanges. Those addresses soaked up 84% of the transferred funds.

The withdrawals started November 1. OKX moved first at 12:25 UTC, with Kraken following 44 minutes later, and Crypto.com handling part of the transfers too. Kraken carried roughly 95% of the total Bitquery identified. About $73.2 million was out the door within three hours, and the last identified withdrawal landed the next morning.

One pattern stood out: a single receiving address collected 43 Kraken transactions in 91 minutes, each worth under $50,000. Investigators think that drip-feed structure may have been designed to slip past per-transaction withdrawal limits.

The whitelisted-address defense didn't help here. If an attacker already holds the keys to a wallet an exchange recognizes as legit, the approval becomes a green light instead of a guardrail. Bitquery also flagged eight Trust Wallet smart accounts among the recipients, but said it found no evidence that a Trust Wallet vulnerability caused the breach. The firm's read is that the attackers likely had both exchange credentials and private keys.

Once the funds landed, they moved fast. Through UniswapX, roughly $62.98 million in USDC and USDT was swapped into 27,553 ETH at an average of about $2,286 per coin. That's a deliberate pivot: USDC can be frozen by issuer Circle, while ETH has no central issuer that can lock a balance. Some funds also slid into DAI, which lacks a similar freeze switch.

By November 2, about $78.27 million was still sitting in addresses tied to the suspected attackers — $68.9 million in ETH, $5.6 million in DAI, and $3.7 million in USDC. The trail is now a race between investigators mapping the wallets and whoever holds the keys deciding where the money goes next.