✓ Verified by 5+ outlets SOL
French bank Crédit Mutuel Arkéa confirms a cyberattack after ZachXBT ties it to a $133 million-plus crypto theft
🔴BearishAnother nine-figure theft from exchange accounts, days after the Binance hack and the Mercado Bitcoin breach, adds to security worries around centralized exchanges.News sentiment, not financial advice. It reflects the likely impact of this news, not a price prediction.
Summary
An unidentified entity in the European Union is suspected of losing more than $106 million from accounts at several centralized crypto exchanges on Sunday, pseudonymous onchain investigator ZachXBT said Monday, according to CoinDesk, Decrypt and Cointelegraph.
The funds were withdrawn as USDC and USDT, then the suspected attacker swapped USDC for ETH, used instant exchange services including WellWallet and Kyrrex, converted funds into Monero through the swap service Wagyu and bridged assets across several blockchains, Decrypt and Cointelegraph reported.
ZachXBT said with a high degree of confidence that the theft is not the work of North Korea's Lazarus Group, citing multiple laundering indicators, which sets it apart from the Binance hack the FBI attributed to the North Korean group TraderTraitor, per Decrypt.
Neither the victim nor the exchanges involved have been named, and Decrypt said it is unclear whether any of the funds have been frozen.
Updates
- Update, : Update (Nov. 3, morning): ZachXBT said he found another $27 million in withdrawals, raising the suspected losses to more than $133 million, Cointelegraph reported. Kraken said it has restricted accounts linked to the funds and is working with law enforcement, while saying the incident did not originate on its platform and its systems were not compromised; Crypto.com said it blocked related funds, and OKX said it was looking into the matter. ZachXBT said his working theory is that a large Western European financial institution was exploited and it is being covered up, a claim Cointelegraph noted is unverified.
- Update, : Update (Nov. 3, night): ZachXBT identified French cooperative bank Crédit Mutuel Arkéa as the alleged victim, saying the theft spanned multiple days and that losses could be higher than $133 million once over-the-counter activity is counted, Cointelegraph and The Block reported. The bank has not confirmed or denied the incident and did not respond to either outlet; both stress the claim rests on ZachXBT's own analysis and has not been independently verified. The Block said ZachXBT criticized the institution for allegedly allowing more than $30 million to be laundered, and that the bank has about 211.5 billion euros (around $237 billion) in assets, while ZachXBT described it as having about $235 billion.
- Update, : Update (Nov. 4): Crédit Mutuel Arkéa confirmed to CoinDesk and Decrypt that it was hit by a cyberattack that enabled fraudulent transactions, saying the incident is now under control, customers' assets were not affected and it has notified the relevant authorities. The bank did not say how much was taken or whether crypto was involved, and said the amounts are still being assessed but do not threaten the group's financial health, Decrypt reported. Blockchain analytics firm Bitquery traced $108.8 million in USDC withdrawn from accounts at Kraken, Crypto.com and OKX over 21 hours on Nov. 1-2, CoinDesk reported; OKX said it froze an institutional customer account after unusual activity. CoinDesk put the bank's assets under management above $250 billion, while ZachXBT described it as a bank with $235 billion in assets, per Decrypt.
- Update, : Update (Nov. 4, afternoon): Crédit Mutuel Arkéa said the cyberattack came through a service provider and enabled fraudulent transfers from its own account, Bitcoin Magazine reported; the bank has not confirmed ZachXBT's estimate of more than $133 million in losses.
- Update, : Update (Nov. 4, night): In a Wednesday statement reported by The Block, Crédit Mutuel Arkéa said it has not confirmed the exact loss but validated the order of magnitude of ZachXBT's $133 million-plus estimate, said some stolen funds have been blocked, and said the amounts do not threaten its financial soundness. ZachXBT has said he has a "high degree of confidence" the attacker is not tied to North Korea's Lazarus Group.
- Update, : Update (Nov. 5): Crédit Mutuel Arkéa said nearly all operations resumed Wednesday after security checks, that customer funds were unaffected and that only some transfers were delayed, Cointelegraph reported. The bank said attackers accessed systems through a service provider—not its online banking subsidiary Fortuneo—and moved the bank's own money to other institutions, potentially enabling crypto conversion; it again declined to confirm exact loss figures while affirming the approximate scale and saying some funds remain frozen.
Key facts
- ZachXBT identified 11 wallet addresses associated with the funds.
- Swapping out of USDC and USDT matters because the companies behind those stablecoins can freeze them; in the Binance case Tether froze stolen USDT on Ethereum in 37 minutes and Circle froze all $823 million in stolen USDC, according to Elliptic.
- Separately, a wallet tied to King, an automated arbitrage bot on Solana, may have lost about $786,000 on Monday, according to the monitoring account Onchain Lens, which said the funds moved through several Solana wallets and then to Ethereum via the bridging service Mayan.
- The outlets size the earlier Binance hack differently: Cointelegraph says $6.3 billion and Decrypt about $6.4 billion.
- The victim and affected exchanges remain unknown.
Related stories
- Binance sets aside $6.34 billion to cover record hack as TRM and Chainalysis tie it to North Korea's TraderTraitor
- DTCC will plug its tokenized stocks, ETFs and Treasuries into Solana in the second half of 2027
- Formation plans the first Solana tokenized stock venue under the SEC's exemption, with Galaxy, Exodus and Forward signed on