What Kraken has confirmed
In a response to Cointelegraph, Kraken said it was investigating reports that some assets connected to the incident subsequently moved through accounts on its platform. It restricted the accounts in question and is working with law enforcement to support recovery. The exchange said the incident did not begin on Kraken, its security systems were not breached, and ordinary customer accounts had not been taken over in an exchange compromise.
That statement does not mean $133 million has been frozen or returned. Kraken did not disclose how many accounts were restricted or how much those accounts held. Crypto.com separately told Cointelegraph it had acted to block related funds; OKX said it was looking into the matter at the time of the initial report. These responses establish an investigation into suspicious flows, not a final account of how the incident began.
The source of the $133 million estimate
Onchain investigator ZachXBT initially reported more than $106 million in withdrawals from centralized exchange accounts. The following day he identified roughly $27 million more and raised his estimate of suspected losses to over $133 million. His theory that a Western European financial institution was affected was not a public confirmation by that institution. At the time of the original report, no victim had disclosed the loss or its circumstances.
The number in headlines is therefore an estimate of a suspected incident, not an amount stolen directly from Kraken. Exchange withdrawals, subsequent blockchain transfers, and a proven loss to a particular owner are different facts. The public evidence does not yet justify treating them as interchangeable.
What the onchain investigation found
Bitquery traced $108.80 million in USDC withdrawn on November 1 and 2 from accounts at Kraken, Crypto.com and OKX to 15 Ethereum addresses. Eleven of those addresses had received payments from the same exchanges before. That pattern has several possible explanations, including an attacker gaining access both to exchange accounts and to previously used wallets. It does not by itself prove the method of compromise.
Bitquery also found that about $62.98 million in stablecoins was converted into ETH through UniswapX within hours. At its November 3, 13:27 UTC snapshot, roughly $61 million remained at related Ethereum addresses. The researchers identified a 396 ETH transfer into a Kraken deposit address. Kraken can identify the owner of that deposit account, but public blockchain data cannot show who it is or whether the assets are in an account already restricted.
The important gaps
Bitquery examined Ethereum and the main wallets of three exchanges, not every chain and venue. Its $108.80 million traced total does not independently establish ZachXBT's broader estimate of over $133 million. Nor could the firm identify the owner of the funds or determine from blockchain data alone how access was obtained. Any claim about the victim needs separate official confirmation, which was absent from the initial investigation.
For Kraken customers, restricting particular linked accounts is not the same as a breach of the exchange's infrastructure or a general account freeze. The case nevertheless illustrates the risk of keeping exchange access and withdrawal-wallet keys together. Separating keys, reviewing withdrawal allowlists and using a delay before newly added addresses become active can reduce that exposure, though none of those measures establishes what happened here.
