Is a $235B French bank staying silent over a $133M crypto theft?

ZachXBT has identified Crédit Mutuel Arkea as the European entity that lost $133M. In the past few days, the on-chain researcher tracked large-scale suspicious outflows from an entity’s wallets, suggesting a large European institution was compromised. 

On-chain researcher ZachXBT tracked $133M in suspicious transactions in the past few days, tracking the losses to a European entity. 

The losses reportedly came from the crypto wallets of the French banking group Crédit Mutuel Arkea. The banking entity carries over $235B in total assets, with crypto making up a small part of its portfolio. 

The attack against the wallets took multiple days and included on-chain swaps and operations. ZachXBT is still searching for more losses and attempts at laundering the funds. 

Crédit Mutuel Arkea is a regional brand of the wider Crédit Mutuel Group. In addition to banking and insurance, the group offers banking services and white-label payment processing for fintechs and neobanks. Some of its clients also carry crypto, including Stripe. 

The Arkéa Banking Services (ABS) subsidiary also offers SEPA transfers, fiat on-ramps and accounts for MiCAR-compliant fintechs. The bank and its subsidiaries have not disclosed their crypto holdings or public-facing wallets. The transactions intercepted by ZachXBT were only caught due to observing some of the commonly used centralized exchanges.

ZachXBT tracks transactions from centralized exchanges

The attack affecting Credit Mutuel took funds from a series of centralized exchange accounts. On November 2, ZachXBT identified $106M losses from multiple centralized exchange accounts. The funds were withdrawn in USDC and USDT. 

The threat actor then swapped USDC for ETH through instant exchanges WellWallet, Kyrrex and others. Some of the funds were converted to Monero (XMR) through Wagyu Wallet and bridged to other chains. 

ZachXBT noted the model of laundering did not fit with the usual operating procedures of the Lazarus group. North Korean hackers usually move the funds quickly through on-chain operations, most often using Ethereum and its mixers. Swapping through centralized exchanges is an unusual laundering pattern. 

Threat actor moved funds out of a Kraken exchange account

Some of the funds were withdrawn from the Kraken hot wallet, based on the threat actor’s wallets aggregated by ZachXBT. Later, the funds were split into smaller reserves and moved to new addresses. After a day of attacks, Kraken restricted the wallets linked to the exploit, though funds have not been frozen. 

The first wave of attacks used 11 new wallets, predominantly withdrawing funds from Kraken’s hot wallet. Several transactions originated from Crypto.com and OKX wallets, suggesting multiple compromised accounts. The second wave of withdrawals, moving another $27M, also mostly affected Kraken wallets. 

ZachXBT noted the exchange withdrawals continued even after the initial announcement, with no immediate comment from the French bank. 

‘My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up,’ commented ZachXBT through his Telegram channel. To date, ZachXBT noted over $30M had already been laundered, with no signs of asset freezes by EU law enforcement. 

Threat actor turned into ETH whale

The unknown threat actor also triggered on-chain explorers in the past week by acting as a large-scale ETH buyer. 

The first sign was an unknown wallet buying $27,553 ETH at an average price of $2,286 per ETH. After the recent price dip, whales moving in at scale was not unusual.

Only later was the whale address identified as being connected to the ongoing exploit. Instead of holding the ETH as reserves, the wallet started laundering the funds through multiple apps and platforms. 

Despite the withdrawals in USDC and USDT, the stablecoins have not been frozen. The decision is in contrast with the fast reaction to the recent Binance hack, where Circle and Tether immediately froze the flagged exploiter addresses.