EU crypto heist spurs rapid multi-exchange freeze blitz

The EU’s modern crypto rulebook began tightening in 2018, when it moved to close a long-criticized regulatory gap by extending anti-money-laundering duties to crypto firms, including exchanges and wallet custodians. On 30 May 2018, the bloc adopted the Fifth Anti-Money Laundering Directive, Directive (EU) 2018/843, which “extended AML obligations to virtual-currency businesses including exchanges and custodian wallet providers,” and required member states to transpose it by “10 January 2020,” addressing “the regulatory gap where crypto exchanges operated outside the regulated financial per.”

That AML expansion was followed in 2020 by a broader market-structure push, as the European Commission advanced the EU’s crypto framework through its Digital Finance Strategy and paired it with concrete legislative proposals for crypto markets and transfers. On 24 September 2020, the Commission adopted the strategy alongside proposals for the Markets in Crypto-Assets Regulation, or MiCA, and a revised Transfer of Funds Regulation, a package described as aiming to “address financial crime and market integrity risks left unresolved by the 2018 AM.”

The timing mattered because the thefts were quickly identified as a cross-platform compromise of EU-linked accounts rather than a one-off breach: CryptoNews.net’s headline, “ZachXBT Flags Potential $106 Million EU Crypto Loss Across Multiple Exchanges,” was followed by “ZachXBT Flags Crédit Mutuel Arkéa as Victim of $133 Million Crypto Heist,” tying the activity to a named EU financial institution. That pattern fits the broader warning that exchange breaches often stem from operational weaknesses and human compromise across centralized systems, not just a single technical failure at one venue.

What turned the episode into an urgent multi-exchange response was the speed of conversion and the ability of defenders to react while funds were still moving: “What we saw in the first really moments of this attack was tether and circle taking back about 40% of the assets stolen because of those capabilities in using that.” At the same time, “over the last 36 hours… working closely with almost every cryptocurrency exchange as part of the Beacon network… they have been acting in real time on alerts… freeze funds as part of this attack and work together,” a posture reflected in the headlines “Mercado Bitcoin Halts Withdrawals After $40 Million Multi-Chain Hack Revealed” and “Kraken and Crypto.com Freeze Over $133 Million Linked to Suspected EU Crypto Heist.”

The laundering pattern that set off the freeze campaign was visible almost immediately in the on-chain trail: as Decrypt put it in a headline, “ZachXBT Flags $106 Million EU USDC/USDT Heist, Funds Swapped to ETH then Monero.” That sequence matters because it shows the stolen funds leaving centralized exchange-linked stablecoin balances, being converted into Ethereum for mobility, and then pushed onward through harder-to-police privacy rails, exactly the kind of cross-asset, cross-service movement that forces investigators to trace address by address before the money disappears into less recoverable endpoints.

That is why the response became a multi-exchange freeze effort rather than a single-platform incident: “Probably within about 20 minutes of the hack, we were already seeing some of those actions take place,” as analysts described the first tracing and intervention steps. Because investigators could follow balances as they hopped addresses and then flag them when they neared centralized services or other cash-out points, the rapid swaps into Ethereum and beyond created urgent choke points for coordinated action; in that context, “having 3 billion frozen in the first day is very significant.”