Kraken EU theft accounts restricted after $133M probe

Another large European crypto theft is testing how quickly centralized venues can freeze funds. Kraken EU theft accounts tied to the probe were restricted after on-chain investigator ZachXBT lifted the suspected haul above $133 million, while the exchange insisted the incident did not originate on its systems.

What happened

Cointelegraph reported that Kraken restricted linked accounts and said its systems and customers were not compromised. ZachXBT raised the estimate from about $106 million on Monday to more than $133 million after roughly $27 million of additional centralized-exchange withdrawals on Tuesday. Bitquery figures cited in the same report put about $62.98 million of stables converted into 27,553 ETH in roughly four hours, with about $78.3 million still in attacker wallets and $30.5 million moved as of Monday 13:47 UTC.

Stablecoin issuers and peers are already in the containment loop. Circle freezeable USDC was put near $3.74 million, Tether had already frozen about $1.1 million USDT, Crypto.com blocked associated funds and OKX said it was looking into linked activity, Cointelegraph reported.

The Defiant confirmed Kraken's account restrictions amid the more-than-$133 million suspected EU theft and repeated the exchange's claim that its own systems and customer accounts were not compromised while it works with law enforcement on recovery.

The Defiant's confirmation that Kraken is working with law enforcement on recovery sits alongside Crypto.com's fund blocks and OKX's review, painting a multi-venue containment effort rather than a single-exchange incident response.

Why it matters

The episode sits beside a brutal week for exchange security narratives. Our report on the Mercado Bitcoin hack showed how quickly hot-wallet drains force deposit pauses; Kraken's response here is account-level restriction rather than a platform-wide halt, a different containment model for an off-platform origin claim.

Issuer freezes remain the first recovery tool. Coverage of the Circle and Tether freeze after the Binance incident underlined how much stolen value still depends on USDC and USDT cooperation once coins hit CEXs.

Kraken EU theft accounts being limited without a Kraken-origin breach also highlights third-party and regional custody risk: victims may sit on EU platforms while liquidity and freezes concentrate on global venues.

Attribution and cover-up claims circulating around the EU theft also raise disclosure stakes for regional platforms whose customers may have been hit even when global CEXs insist their own hot wallets were never the origin of the drain. Circle's freezeable USDC pool near $3.74 million remains small versus the more-than-$133 million suspected haul, so issuer tools alone will not close the recovery gap without further CEX freezes.

What's next

Watch whether more stablecoin freezes land and whether OKX or Crypto.com disclose recovered totals. Cointelegraph's ZachXBT update tracks the rising estimate and CEX responses.

Further on-chain withdrawals from suspected wallets would pressure remaining Kraken EU theft accounts still under review.

Law-enforcement recovery timelines will decide how much of the $133 million-plus haul victims ultimately see returned.

Investigators will next track whether remaining attacker-wallet balances move into mixers, bridges or fresh CEX deposit clusters that could trigger additional freezes beyond the early USDC and USDT totals already disclosed. Victims and counterparties will separately pressure EU platforms for clearer timelines on how restricted balances and frozen stables are reconciled once law-enforcement holds lift.