Onchain investigator ZachXBT has identified Crédit Mutuel Arkéa, a major French cooperative bank, as the alleged victim of a crypto theft exceeding $133 million. The investigation points to a series of withdrawals made from the bank’s centralized exchange accounts over several days, primarily involving the stablecoins USDC and USDT.
Alleged Exploit and Initial Findings
The theft first came to light on November 2, when ZachXBT reported that an unnamed European Union entity had suffered losses of over $106 million from multiple exchange accounts. Withdrawals occurred the day before, targeting both USDC and USDT. ZachXBT, who is known for his detailed blockchain analyses, withheld the institution’s name initially but soon linked the activity to a large Western European financial institution. He further implied that the incident might be subject to a cover-up.
On November 3, ZachXBT updated his estimate to more than $133 million after tracing a further $27 million in withdrawals, including some transactions that took place after his initial public alert. He then publicly named Crédit Mutuel Arkéa as the alleged victim, noting that the attack took place across multiple days and warning that total losses could rise if potential over-the-counter trading is considered.
ZachXBT expressed the possibility that “real losses may be even higher” and raised concerns over a lack of disclosure, suggesting proper notification to European Union authorities might have enabled law enforcement to freeze some of the stolen assets.
Movement of the Stolen Assets
According to ZachXBT, the perpetrator swiftly converted the stolen stablecoins into other cryptocurrencies. The attacker reportedly “aggressively swapped USDC for ETH” in the 24 hours following the attack. Funds were then transferred through instant exchanges such as WellWallet and Kyrrex, and subsequently routed to Monero using Wagyu. Portions of these assets were bridged across several blockchain networks, complicating efforts to track their movement.
ZachXBT emphasized that the theft process demonstrated advanced tactics to obfuscate the funds’ origin, with Monero’s privacy features making subsequent tracing efforts significantly more challenging.
Mini dictionary: Monero is a privacy-centric cryptocurrency designed to provide untraceable transactions by obscuring the sender, receiver, and transaction amount. Its advanced privacy features make it a common tool for illicit financial activity involving digital assets.
Potential Perpetrator and Institutional Response
The onchain analyst stated with “a high degree of confidence” that the attacker does not appear to be linked to the notorious Lazarus Group, a North Korean hacking organization frequently tied to major crypto exploits. He also criticized the bank for allegedly enabling more than $30 million to be laundered, believing that earlier alerting of law enforcement could have led to freezing part of the stolen sums.
ZachXBT has previously raised concerns over Circle, the issuer of USDC, particularly regarding delays in freezing accounts and tokens involved in illegal activity.
Crédit Mutuel Arkéa serves more than 5.6 million clients across France, with reported assets totaling €211.5 billion, or approximately $237 billion. The institution has neither confirmed nor denied the breach and has not issued any public comment or acknowledgment regarding the alleged incident. Independent verification of the claims has not yet been provided by either the bank or regulatory authorities.
| Bank | Reported Loss | Customer Base | Total Assets |
|---|---|---|---|
| Crédit Mutuel Arkéa | $133 million | 5.6 million+ | $237 billion |
The situation has drawn attention across the crypto sector, with observers watching to see how both regulators and the financial institution will respond to the revelations. As of now, Crédit Mutuel Arkéa has not addressed the reported theft or its implications.
