TLDR
- Onchain investigator ZachXBT named French bank Crédit Mutuel Arkéa as the alleged victim of a crypto theft worth more than $133 million.
- The funds were taken from multiple centralized exchange accounts as USDC and USDT over several days.
- The attacker swapped USDC for ETH, used instant exchanges, and converted funds to Monero through Wagyu.
- ZachXBT said he is highly confident the attacker is not linked to North Korea’s Lazarus Group.
- The bank has not confirmed or denied the incident, and the claims have not been independently verified.
A French cooperative bank has been named as the alleged victim of a crypto theft worth more than $133 million. Onchain investigator ZachXBT said on Nov. 3 that the institution is Crédit Mutuel Arkéa.
The bank has not confirmed or denied the incident. The claims are based on ZachXBT’s own analysis and have not been independently verified by the bank or authorities.
ZachXBT has tracked the stolen money as it was swapped, bridged and converted over several days. Part of the funds ended up in Monero, a privacy-focused cryptocurrency.
How the Theft Was First Reported
ZachXBT first reported on Nov. 2 that an unnamed European Union entity had lost over $106 million. The funds were taken from multiple centralized exchange accounts the day before.
The money was withdrawn in two stablecoins, USDC and USDT. At that point, ZachXBT did not name the institution.
A day later, he raised the estimated total to more than $133 million. He said he traced another $27 million in withdrawals, and some of those took place after his first public post.
Before naming the bank, he suggested that a large financial institution in Western Europe had been exploited. He also said he believed the incident was being covered up.
On the evening of Nov. 3, he said the institution was allegedly Crédit Mutuel Arkéa. He added that the attack spanned multiple days.
He also said the real losses could be higher. The total could grow once possible over-the-counter trading activity is taken into account.
Tracing the Stolen Funds
According to ZachXBT, the attacker moved quickly after the theft. In his Nov. 2 Telegram message, he said the actor had been “aggressively swapping USDC for ETH” over the prior 24 hours.
The funds were then sent to instant exchanges, including WellWallet and Kyrrex. From there, the attacker converted funds to Monero through Wagyu and bridged them across multiple blockchains.
Once funds are converted to Monero, they become much harder to trace. Bridging across chains also adds more steps between the stolen money and where it ends up.
ZachXBT said he has a “high degree of confidence” that the attacker is not linked to North Korea’s Lazarus Group. Lazarus is a North Korean hacking group often blamed for large crypto thefts.
He also criticized the institution for allegedly allowing more than $30 million to be laundered. He said proper disclosure of the incident to EU law enforcement could have led to the funds being frozen.
ZachXBT has raised concerns about frozen funds before. He has previously accused Circle, the issuer of USDC, of being slow to freeze tokens tied to illicit activity.
Crédit Mutuel Arkéa has more than 5.6 million customers. It holds total assets of 211.5 billion euros, or about $237 billion.
The Block said it reached out to the bank but had not heard back. As of publication, Crédit Mutuel Arkéa has not issued any public statement on the alleged theft.
