Arkéa’s alleged $133M crypto drain leaves a $106M trail—and a $30M laundering gap

Crédit Mutuel Arkéa has been identified by onchain investigator ZachXBT as the alleged victim of a cryptocurrency theft exceeding $133 million, though the French banking group has not publicly confirmed involvement or disclosed how its funds were accessed. “Disclosing the EU financial institution exploited for $133M+ is allegedly Credit Mutuel Arkea, a French bank with $235B in assets,” ZachXBT wrote. He added that the alleged attack occurred over multiple days and may have produced larger losses once over-the-counter (OTC) activity is included.

ZachXBT first flagged the incident on November 2, reporting that an unidentified European Union entity had lost more than $106 million from accounts held at several centralized exchanges. Suspected stolen funds were withdrawn as $USDC and $USDT before the attacker converted $USDC into $ETH, used instant exchange services including WellWallet and Kyrrex, moved assets through multiple blockchains and converted some funds into privacy coin $XMR through Wagyu. A further $27 million in withdrawals, some occurring after the initial disclosure, raised the estimated total above $133 million.

Blockchain analytics firm Bitquery traced approximately $108.8 million in $USDC associated with the suspected theft as it left accounts at Kraken, Crypto.com and OKX over roughly 21 hours on November 1 and November 2. The firm also found that $62.98 million in stablecoins was converted into 27,553 $ETH within roughly four hours. Kraken and Crypto.com subsequently restricted accounts or blocked funds tied to the suspected theft, while both exchanges said their platforms remained secure.

ZachXBT published 11 Ethereum addresses linked to the suspected attacker and later disclosed four additional addresses. He said only $3.74 million remained in $USDC that Circle could potentially freeze, with approximately $78.3 million still in linked wallets as of 13:47 UTC Monday and $30.5 million having moved beyond the tracked addresses. “No proper incident disclosure has resulted in $30M+ being laundered away which could have been frozen by EU law enforcement,” he wrote.

The alleged victim’s identity and ZachXBT’s suggestion that the incident was being covered up remain unverified, as does the reported scale of any additional OTC losses. ZachXBT previously said the laundering patterns did not match those typically used by North Korea’s Lazarus Group, while the victim, attackers and method of access remain unidentified.