In brief
- Onchain investigator ZachXBT has named French banking group Crédit Mutuel Arkéa as the alleged victim of a crypto theft of more than $133 million.
- ZachXBT said the attack took place over multiple days, and that he suspects the total is higher once over-the-counter activity is counted.
- The bank has not publicly confirmed any theft.
Onchain investigator ZachXBT has named French banking group Crédit Mutuel Arkéa as the alleged victim of a crypto theft of more than $133 million.
"Disclosing the EU financial institution exploited for $133M+ is allegedly Credit Mutuel Arkea, a French bank with $235B in assets," ZachXBT wrote on his Telegram channel on Tuesday. "The attack on the bank occurred for multiple days. I suspect the amount stolen is larger when accounting for OTC activity."
Crédit Mutuel Arkéa has not publicly confirmed any theft. Decrypt has reached out to the bank for comment.
The mutual banking group has been preparing to move into crypto. In May, French financial newspaper L'Agefi reported that it had applied for a license under MiCA, the EU's crypto rulebook, to offer crypto services to its retail customers and to provide them as a white-label service through its Arkéa Banking Services division.
ZachXBT first flagged the suspected theft on Monday, saying an unnamed entity in the European Union may have lost more than $106 million from accounts at several crypto exchanges on November 1. The funds were withdrawn as USDC and USDT, he said in his original post, and the attacker then swapped USDC for ETH, moved funds through instant exchanges, converted some into privacy coin Monero and bridged across multiple chains.
In an update earlier on Tuesday, he said he had identified a further $27 million in exchange withdrawals by the attacker, bringing the total to more than $133 million, and that some of those withdrawals took place after his initial disclosure. He also published four Ethereum addresses he said were linked to the theft.
"My working theory is a large financial institution in Western Europe was exploited and it's currently being covered up," ZachXBT wrote at the time, accusing it of not having conducted "proper incident disclosure" and thereby preventing law enforcement from freezing some $30 million in stolen funds.
He did not say how he had identified the bank, or how the attacker gained access to its exchange accounts.
The allegation comes days after the $6.3 billion hack of Binance, the largest crypto theft on record, which the FBI has attributed to North Korean hackers. ZachXBT said the attacker in the suspected EU theft remains unidentified, but that he could say "with a high degree of confidence it is NOT Lazarus Group," the North Korean hacking collective, "based on multiple laundering indicators."