On-chain researcher ZachXBT, known for tracking hacks and stolen funds across blockchains, has identified French banking group Crédit Mutuel Arkéa as the European entity behind approximately $133 million in suspicious crypto outflows he tracked over the past several days. The findings suggest that a large European institution was compromised, and the French bank has not immediately commented.

The losses reportedly came from the crypto wallets of Crédit Mutuel Arkéa, a regional brand of the wider Crédit Mutuel Group. The banking entity holds more than $235 billion in total assets, with crypto making up only a small part of its portfolio. The attack against the wallets spanned multiple days and included on-chain swaps and other operations, and ZachXBT is still searching for additional losses and attempts to launder the funds.

Crédit Mutuel Arkéa's footprint extends beyond banking and insurance. The group provides banking services and white-label payment processing for fintechs and neobanks, some of which hold crypto — including Stripe. Its subsidiary, Arkéa Banking Services (ABS), offers SEPA transfers, fiat on-ramps and accounts for MiCAR-compliant fintechs — that is, firms operating under the EU's Markets in Crypto-Assets framework. The bank and its subsidiaries have not disclosed their crypto holdings or public-facing wallets, which is why the suspicious transactions were only detected by monitoring some of the most commonly used centralized exchanges.

Funds moved through centralized exchanges

The attack drained funds from a series of centralized exchange accounts. On November 2, ZachXBT identified $106 million in losses across multiple centralized exchange accounts, with the funds withdrawn in USDC and USDT, the stablecoins issued by Circle and Tether respectively.

The threat actor then swapped USDC for ETH through instant exchanges including WellWallet and Kyrrex, among others. Some of the funds were converted to Monero (XMR), a privacy-focused asset that obscures transaction details by design, through Wagyu Wallet and bridged to other chains.

ZachXBT noted that this laundering model does not fit the usual operating procedures of the Lazarus group, the hacking collective attributed to North Korea. North Korean hackers typically move stolen funds quickly through on-chain operations, most often using Ethereum and its mixers, making swaps through centralized exchanges an unusual laundering pattern.

Withdrawals concentrated in Kraken accounts

Based on the threat actor wallets aggregated by ZachXBT, part of the funds was withdrawn from a Kraken hot wallet and later split into smaller reserves and moved to new addresses. After a day of attacks, Kraken restricted the wallets linked to the exploit, though the funds have not been frozen — a restriction that halts activity through the flagged accounts but leaves the tokens themselves untouched.

The first wave of attacks used 11 new wallets, predominantly withdrawing funds from Kraken's hot wallet. Several transactions also originated from Crypto.com and OKX wallets, suggesting multiple compromised accounts. A second wave of withdrawals moved another $27 million, again mostly affecting Kraken wallets.

The exchange withdrawals continued even after ZachXBT's initial announcement, with no immediate comment from the French bank. "My working theory is a large financial institution in Western Europe was exploited and it's currently being covered up," ZachXBT commented through his Telegram channel. To date, he noted, over $30 million has already been laundered, with no signs of asset freezes by EU law enforcement.

Threat actor turned ETH whale

The unknown attacker also drew the attention of on-chain explorers over the past week by acting as a large-scale ETH buyer. The first sign was an unknown wallet purchasing 27,553 ETH at an average price of $2,286 per ETH. Following the recent price dip, whales moving in at scale was not unusual, and only later was the whale address identified as connected to the ongoing exploit.

Instead of holding the ETH as reserves, the wallet began laundering the funds through multiple apps and platforms.

Despite the withdrawals in USDC and USDT, the stablecoins have not been frozen. That decision contrasts with the fast reaction to the recent Binance hack, where Circle and Tether immediately froze the flagged exploiter addresses. Whether either issuer extends the same treatment to the addresses linked to this case, and whether Crédit Mutuel Arkéa addresses the breach publicly, remain unresolved.