A $133M Vanish Act: ZachXBT Names an Alleged EU Banking Victim

Onchain investigator ZachXBT identified French banking group Crédit Mutuel Arkéa as the alleged victim of a crypto theft exceeding $133 million, warning that total losses could be higher after additional withdrawals and over-the-counter (OTC) activity were considered. The institution, which ZachXBT described as having $235 billion in assets, was allegedly exploited over multiple days. He did not disclose how the attackers gained access to the funds. “I suspect the amount stolen is larger when accounting for OTC activity,” ZachXBT said. Crédit Mutuel Arkéa’s alleged involvement has not been independently verified, and the bank had not responded to Cointelegraph by publication.

The investigation began with ZachXBT’s Monday report of more than $106 million withdrawn from accounts at multiple centralized exchanges operated by an unidentified entity in the European Union. On Tuesday, he said he found another $27 million in withdrawals, including some made after his initial disclosure, and raised the estimate to more than $133 million. “My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up,” he wrote on his Telegram channel. ZachXBT said the victim’s identity and allegations of a cover-up remain unverified, and that the lack of proper incident disclosure allowed more than $30 million to be laundered.

Blockchain analytics firm Bitquery traced withdrawals from accounts at Kraken, Crypto.com and OKX, finding that $62.98 million in stablecoins was converted into 27,553 Ether (ETH) within roughly four hours. As of 13:47 UTC Monday, approximately $78.3 million remained in wallets linked to the suspected attacker, while $30.5 million had moved beyond the tracked addresses. Only $3.74 million remained in USDC that issuer Circle could potentially freeze. Kraken and Crypto.com restricted related accounts or blocked funds, while both exchanges said their platforms remained secure.

ZachXBT said the attacker withdrew USDC and USDT, swapped USDC for ETH, used instant exchange services including WellWallet and Kyrrex, and converted funds into Monero (XMR) through Wagyu. He published 11 wallet addresses tied to the suspected theft and said the laundering patterns did not match those typically used by North Korea’s Lazarus Group. He previously said he could say “with a high degree of confidence” that the attacker was not Lazarus Group. It remains unclear whether any funds have been frozen.

Separately, a wallet associated with King, an automated arbitrage bot on Solana, may have lost about $786,000 on Monday, according to pseudonymous blockchain monitoring account Onchain Lens. The funds moved through several Solana wallets before being transferred to Ethereum using Mayan. “Our report is based on unusual fund movements, rapid transfers and the subsequent cross-chain movement of funds, which we believe indicates an attempt to obscure their origin,” Onchain Lens told Cointelegraph. “This pattern strongly suggests a potential wallet compromise.” King’s operator has not confirmed a compromise.

The alleged Crédit Mutuel Arkéa losses followed the reported Oct. 29 Binance hack, described as both $6.3 billion and $6.4 billion in different reports. The FBI attributed the attack to North Korean hackers known as “TraderTraitor,” a group linked to Lazarus. Tether froze stolen USDT on Ethereum in 37 minutes, while Circle froze all $823 million in stolen USDC, helping lock up about 44% of the haul, according to Elliptic. North Korea’s launderers reportedly spread the remaining funds across about 12,000 wallets. Mercado Bitcoin also halted withdrawals after a $40 million hack, while BTCPay Server told merchants to switch off their servers amid reports of hot wallet attacks.