The $133M crypto drip grew overnight—and now has a bank-shaped suspect

Onchain investigator ZachXBT identified French banking group Crédit Mutuel Arkéa as the alleged victim of a cryptocurrency theft exceeding $133 million, saying the institution’s total losses could be higher. The allegation, which the bank has not publicly confirmed, follows ZachXBT’s initial report on Monday, November 1, that an unidentified European Union entity may have lost more than $106 million from accounts at multiple centralized exchanges.

ZachXBT said the attack on Crédit Mutuel Arkéa occurred over multiple days and published four Ethereum addresses linked to the suspected theft. “I suspect the amount stolen is larger when accounting for OTC activity,” he wrote. The bank, which ZachXBT described as having $235 billion in assets, has not independently verified the allegation and had not disclosed how the attacker gained access. Crédit Mutuel Arkéa did not respond to requests for comment.

ZachXBT raised the estimate to more than $133 million on Tuesday after identifying another $27 million in exchange withdrawals, some of which occurred after his initial disclosure. “My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up,” he wrote on his Telegram channel. He added that the absence of proper incident disclosure allowed more than $30 million to be laundered, claiming European Union law enforcement could otherwise have frozen the funds. The victim’s identity and the alleged cover-up remain unverified.

Blockchain analytics firm Bitquery traced withdrawals from accounts at Kraken, Crypto.com and OKX, finding that approximately $62.98 million in stablecoins was converted into 27,553 Ether ($ETH) within roughly four hours. Kraken and Crypto.com subsequently said they had restricted accounts or blocked funds associated with the suspected theft, while both exchanges said their platforms remained secure. As of 13:47 UTC Monday, approximately $78.3 million remained in wallets linked to the suspected attacker, while $30.5 million had moved out of the tracked addresses. Only $3.74 million remained in USDC that issuer Circle could potentially freeze.

ZachXBT said the stolen USDC and USDT were swapped for Ether ($ETH), moved through instant exchanges including WellWallet and Kyrrex, and converted in part into Monero ($XMR) through Wagyu. He said the laundering indicators did not match those typically associated with North Korea’s Lazarus Group and stated that he could say “with a high degree of confidence” the attacker was not from the group. The reported theft came days after the $6.3 billion Binance hack on Oct. 29, which the FBI attributed to North Korean hackers known as “TraderTraitor.”

Separately, a wallet associated with King, an automated arbitrage bot on Solana, may have lost about $786,000 on Monday, according to pseudonymous blockchain monitoring account Onchain Lens. Onchain Lens said the funds moved through several Solana wallets before being transferred to Ethereum using Mayan and that the rapid activity indicated “a potential wallet compromise.” King’s operator had not confirmed a compromise.