A coordinated wave of cryptocurrency theft is quietly unfolding across multiple blockchain networks.

ZachXBT, a well-known blockchain sleuth, has flagged an ongoing series of wallet-draining incidents that have already affected hundreds of users. While individual losses remain relatively small, the cumulative impact continues to grow as more compromised wallets are uncovered.

Hundreds of Users Affected by Low-Value Drains

According to information shared by ZachXBT, the attack has targeted hundreds of wallet addresses, with most victims losing less than $2,000 each. This approach appears designed to keep individual losses below the threshold that typically draws immediate attention.

However, when viewed in aggregate, the damage is more substantial. Current on-chain estimates put total losses at approximately $107,000, a figure that continues to climb as investigators identify additional affected wallets.

Losses Spread Across Major EVM Networks

As investigators traced the stolen funds, a clear multi-chain pattern emerged. Specifically, the attacker operates across several EVM-compatible networks rather than focusing on a single blockchain.

Data from a dashboard shared by ZachXBT shows Ethereum bearing the largest share of losses, with roughly $54,655 drained. BNB Chain follows with approximately $25,545 stolen. Additional losses have been recorded on Base ($8,688), Arbitrum ($6,273), and Polygon ($3,498).

Beyond these networks, smaller amounts have also been siphoned from Optimism, Ink, Zora, Linea, and Manta Pacific, further reinforcing the broad reach of the activity.

No Clear Entry Point Identified So Far

Despite the growing volume of data, investigators have yet to identify a definitive cause. ZachXBT has noted that no specific wallet provider or decentralized application has been conclusively linked to the drains.

Moreover, the pattern of the theft suggests a high degree of automation rather than isolated compromises. Funds are being extracted in small, systematic increments, which points to potential exposure of private keys or misuse of token approvals. For now, however, no confirmed technical explanation has been established.

As part of the ongoing investigation, ZachXBT identified a single address as the primary collection point for the stolen assets:

0xAc2e5153170278e24667a580baEa056ad8Bf9bFB 

Consequently, users are advised to review their transaction histories on tools such as Etherscan or BscScan. Any interaction with this address could indicate exposure to the draining activity.

Incident Follows Trust Wallet Extension Breach

Notably, the alert arrives only days after ZachXBT helped uncover a separate and more severe security incident involving the Trust Wallet browser extension. In that case, a malicious update identified as version 2.68 enabled unauthorized fund withdrawals directly from user wallets.

ZachXBT’s early findings indicated that the incident was not phishing-related, but rather, a supply-chain compromise. Ultimately, the breach resulted in approximately $7 million in losses.

Subsequently, Trust Wallet confirmed the issue and has since begun issuing refunds to users whose losses have been verified.

The UK has launched a significant expansion of crypto tax oversight, marking a new phase in global enforcement and bringing digital assets firmly into the mainstream tax system.

From Thursday, HM Revenue and Customs (HMRC) began collecting detailed transactional data related to cryptocurrencies, according to the Financial Times. The move reflects a growing determination by tax authorities to close long-standing reporting gaps around crypto profits.

Exchanges Ordered to Hand Over Full Records

Under the new rules, crypto exchanges serving UK-based users must submit comprehensive transaction histories to HMRC. Specifically, the data will include purchase prices, sale values, gains or losses, and each user’s tax residency status. The requirement applies to all major platforms serving customers linked to the UK.

The reporting requirements are based on the Cryptoasset Reporting Framework (CARF), developed by the OECD to standardise crypto tax reporting worldwide.

The UK is among the first 48 countries to implement the framework, with more than 75 jurisdictions signed up overall.

While the UK is moving early, other major financial centres are set to follow. For instance, Hong Kong, Switzerland, Singapore, and the UAE are scheduled to begin reporting in 2027. Meanwhile, the United States plans to initiate data collection in 2028, with international information sharing expected to start in 2029.

Automatic Cross-Border Sharing Ahead

HMRC is also preparing for automated exchanges of crypto data with overseas tax authorities. From 2027, crypto trading information will be shared with all EU member states and with jurisdictions such as the Cayman Islands, South Africa, Brazil, and the Channel Islands.

As a result, crypto transactions linked to UK taxpayers will become visible across participating jurisdictions.

Tax professionals say the changes represent a clear turning point. Andrew Park, a tax investigations specialist at Price Bailey, warned that the secrecy surrounding cryptocurrencies is effectively coming to an end. He added that investors in participating countries should expect their records to be shared directly with governments.

Therefore, Park urged traders to review their tax positions now, before compliance issues escalate into criminal investigations.

Broader Tax Exposure for UK Traders

The increased visibility significantly expands tax risk for many UK users. Anyone with more than £3,000 in crypto gains is liable for capital gains tax, while HMRC may apply income tax and national insurance if trading activity appears frequent or business-like.

As a result, how crypto activity is classified now matters as much as the size of the profits. Importantly, tax liabilities are not limited to cash sales. For instance, using cryptocurrency to purchase goods, swapping one token for another, or gifting assets can all count as taxable disposals. However, the only exception applies to transfers between spouses or civil partners.

Each transaction is assessed individually, widening the scope of potential liabilities.

Enforcement Already Intensifying

According to Dawn Register, a tax dispute specialist at BDO, HMRC has long suspected widespread underreporting of crypto gains. She noted that the international framework provides access to far richer datasets, which allows authorities to target suspected non-compliance more precisely.

Indeed, that shift is already reflected in enforcement activity. HMRC sent out 65,000 warning letters during the 2024–25 tax year to individuals thought to have unpaid crypto taxes, up from 27,700 in the previous year. These letters form part of a broader compliance strategy.

New Disclosure Tools and Reporting Rules

HMRC allows taxpayers to voluntarily disclose previously undeclared crypto gains, and experts recommend seeking professional advice before doing so.

The self-assessment tax return now includes a specific section for crypto profits and losses. Anyone with taxable crypto activity in the 2024–25 tax year may need to file a return by 31 January.

Seb Maley, chief executive of tax insurance firm Qdos, said the changes mark a fundamental shift, as HMRC will soon have much clearer visibility over who is making crypto gains and how much they owe.

Overall, the measures signal a move toward far greater transparency in cryptocurrency taxation.