A major cryptocurrency theft has raised questions about the security of traditional financial institutions and their digital asset operations.
Blockchain investigators have traced suspicious transactions to accounts linked to a major European banking group.
The incident also highlights the challenges exchanges and financial institutions face when tracking stolen digital assets. Meanwhile, the absence of a public response has drawn attention to the scale of the reported losses.
ZachXBT links $133M crypto theft to crédit Mutuel Arkéa
On-chain investigator ZachXBT identified Crédit Mutuel Arkéa as the European banking entity behind approximately $133 million in suspected crypto losses. The French banking group holds more than $235 billion in total assets, although cryptocurrency represents only a small portion of its portfolio.
ZachXBT tracked large-scale suspicious outflows over several days, linking the transactions to wallets associated with the banking group. The attacks involved multiple on-chain swaps and transfers across different platforms.
However, the investigator has continued examining additional losses and potential attempts to launder the stolen funds.
Crédit Mutuel Arkéa operates as a regional brand within the wider Crédit Mutuel Group. The group provides banking and insurance services alongside white-label payment processing for fintech companies and neobanks.
Some of its clients also operate in the cryptocurrency sector, including Stripe. Meanwhile, its Arkéa Banking Services (ABS) subsidiary provides SEPA transfers, fiat on-ramps and accounts for MiCAR-compliant fintech businesses.
Neither the bank nor its subsidiaries have publicly disclosed their cryptocurrency holdings or associated wallets. Consequently, investigators identified the suspicious activity through transactions involving commonly used centralized exchanges.
Stolen funds moved through Kraken, Crypto.com and OKX
ZachXBT’s investigation identified approximately $106 million in losses from multiple centralized exchange accounts on November 2. The attacker withdrew funds primarily in USDC and USDT before moving them through several platforms.
The threat actor subsequently exchanged USDC for ETH using instant exchange services, including WellWallet and Kyrrex. Some funds also passed through Wagyu Wallet, where the attacker converted assets into Monero (XMR) and bridged them to other chains.
According to ZachXBT, the laundering pattern differed from the usual methods associated with North Korea’s Lazarus Group. The group typically moves stolen funds quickly through on-chain transactions, often involving Ethereum and cryptocurrency mixers.
However, the suspected attacker relied on centralized exchange withdrawals, an unusual approach compared with those operations.
ZachXBT also traced some withdrawals to Kraken’s hot wallet. The attacker divided the funds into smaller amounts and transferred them to newly created addresses.
The first attack wave involved 11 new wallets, with most withdrawals originating from Kraken. Other transactions involved wallets associated with Crypto.com and OKX, suggesting multiple compromised exchange accounts.
A second withdrawal wave moved another $27 million, again primarily affecting Kraken-linked wallets.
Kraken restricted wallets connected to the suspected exploit after the initial announcement. However, the exchange had not frozen the associated funds.
ZachXBT questions institutional response as $30M gets laundered
The suspicious withdrawals reportedly continued even after ZachXBT publicly raised concerns about the incident. Meanwhile, Crédit Mutuel Arkéa had not issued an immediate public comment on the reported theft.
In his Telegram channel, ZachXBT described his working theory as the exploitation of a large Western European financial institution. He also suggested that the institution could be covering up the incident.
The investigator estimated that more than $30 million had already passed through laundering channels. He also reported no signs of asset freezes by European Union law enforcement at the time.
Meanwhile, the attacker attracted attention from Ethereum market watchers after purchasing 27,553 ETH. The wallet acquired the cryptocurrency at an average price of approximately $2,286 per ETH.
Initially, the large purchase appeared consistent with whale accumulation following a market decline. However, investigators later connected the address to the suspected exploit.
Instead of holding the ETH as reserves, the wallet began moving funds through multiple applications and platforms.
The stolen USDC and USDT also remained unfrozen, according to the investigation. This contrasted with the response to a recent Binance hack, when Circle and Tether quickly froze addresses associated with the attacker.
