ZachXBT Names Crédit Mutuel Arkéa as Victim of $133M Crypto Theft
ZachXBT named Crédit Mutuel Arkéa as the institution behind a crypto theft topping $133 million, with part of the funds converted to Monero. The bank confirmed an attack but gave no loss figure; Crypto.com says it blocked linked funds.
More than $133 million gone from centralized exchange accounts. Onchain investigator ZachXBT said on Nov. 3 that French bank Crédit Mutuel Arkéa is the institution behind it. The bank has since confirmed an attack but has not disclosed what was taken.
The count started lower. On Nov. 2, ZachXBT reported that an unnamed EU entity had lost more than $106 million. He then traced another $27 million in withdrawals and said the total could climb once OTC trades are counted. The funds left as USDC and USDT, taken from multiple centralized exchange accounts.
How the funds moved
ZachXBT's Nov. 2 Telegram message lays out the route. The attacker swapped USDC for ETH, ran funds through instant exchanges including WellWallet and Kyrrex, converted a portion to Monero via Wagyu and bridged across several chains. Investigators have not determined how the attacker got into the exchange accounts.
Blockchain data provider Bitquery traced $108.8 million in USDC withdrawn from Kraken, Crypto.com and OKX accounts over 21 hours on Nov. 1 and 2. The money passed through hundreds of wallets. Much of it became ether.
Bitquery could not verify the full loss or identify the victim. It flagged a 396 ETH transfer to a Kraken deposit address but could not establish whether Kraken froze it.
Bank and exchange responses
The bank confirmed the attack on Wednesday, saying the incident had enabled fraudulent transactions but that the situation was under control. It temporarily suspended some transactions, notified the relevant authorities and is still assessing consequences. No figure for the amount stolen. No word on whether the funds were held in traditional currency or crypto.
"This incident has no financial consequences for [our clients]. Their interests are fully protected,"
A Crédit Mutuel Arkéa spokesperson said.
Crypto.com said it blocked funds linked to the incident. Kraken and OKX did not immediately respond.
"We are aware of this report and have taken action to block funds linked to the incident from moving through Crypto.com. All user funds remain secure and accessible,"
A Crypto.com spokesperson said.
Attribution and criticism
ZachXBT said he has a "high degree of confidence" the attacker is not tied to North Korea's Lazarus Group, citing differences in how the funds were moved. He also criticized the institution for allegedly allowing more than $30 million to be laundered, arguing that proper disclosure to EU law enforcement could have led to funds being frozen.
Those claims rest on his own analysis and have not been independently verified.
Estimates of the bank's size vary: 211.5 billion euros (about $237 billion) in assets and 5.6 million customers by one count, over $250 billion in assets under management by another.
Context
Arkéa has been moving toward crypto. In May, L'Agefi reported that the bank had applied for a MiCA license to offer crypto services to retail customers and financial institutions.
Recent thefts include BTCPay Server, Brazil's Mercado Bitcoin and the $6.3 billion Binance hack, which the FBI attributed to North Korean hackers.
Three questions remain open: the true size of the loss, how the attacker got into the exchange accounts, and whether more funds can be frozen.
