Arkéa’s $133M+ Crypto Hole: A French Bank’s Paper Trail Ends in Ethereum

Crédit Mutuel Arkéa resumed nearly all operations Wednesday after confirming a cyberattack linked to a suspected theft from the bank’s own account, while blockchain investigator ZachXBT estimated that more than $133 million may have been lost. The bank said customer funds were unaffected, although the disruption delayed some transfers, and it was still assessing the financial impact. “We are not confirming these figures; we can only confirm the approximate scale,” Arkéa said, according to a machine translation.

ZachXBT first flagged the incident on Monday after identifying more than $106 million in suspicious withdrawals from centralized exchanges on November 1. The following day, he reported another $27 million in withdrawals, including some made after his initial disclosure, raising the estimated losses above $133 million. “My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up,” ZachXBT wrote. He later identified Arkéa as the alleged victim, describing the attack as lasting multiple days and warning that the total could be higher once over-the-counter activity is included.

Blockchain analytics firm Bitquery traced $108.8 million in USDC tied to the suspected theft leaving accounts at Kraken, Crypto.com and OKX over approximately 21 hours on November 1 and November 2. It found that $62.98 million in stablecoins was converted into 27,553 Ether (ETH) within roughly four hours. ZachXBT published 11 Ethereum addresses associated with the funds and said the attacker swapped USDC for ETH, used instant exchange services including WellWallet and Kyrrex, converted some funds into Monero (XMR) through Wagyu and moved assets across multiple blockchains. Kraken and Crypto.com restricted accounts or blocked funds connected to the incident, while both exchanges said their platforms remained secure.

Arkéa said attackers entered through a service provider rather than its online banking subsidiary, Fortuneo, then transferred the bank’s money to other financial institutions, potentially enabling its conversion into crypto. The bank said some funds had been frozen and recovery efforts were continuing. ZachXBT estimated that the lack of proper incident disclosure allowed more than $30 million to be laundered, which EU law enforcement could otherwise have frozen. He said the laundering pattern did not match that typically used by North Korea’s Lazarus Group, with “with a high degree of confidence it is NOT Lazarus Group,” based on multiple laundering indicators.

Separately, a wallet associated with King, an automated Solana arbitrage bot, may have lost about $786,000 on Monday, according to pseudonymous blockchain monitoring account Onchain Lens. Onchain Lens said the funds moved through several Solana wallets before being transferred to Ethereum using Mayan, a cross-chain asset service, and cited rapid transfers as evidence of a possible attempt to obscure their origin. “This pattern strongly suggests a potential wallet compromise,” Onchain Lens told Cointelegraph, while King’s operator had not confirmed a compromise.