Losses Top $133 Million in Attack Attributed to Crédit Mutuel Arkéa
Key Facts
Crypto investigator ZachXBT said losses exceeding $133 million were linked to accounts at Crédit Mutuel Arkéa, an estimate he raised after tracing additional withdrawals. Separately, the French banking group said on November 4 that it had been hit by a cyberattack that enabled “fraudulent transactions,” and said the incident “was under control.” The bank added that the incident “has no financial impact on customers,” but did not confirm the reported $133 million figure. The estimate published by ZachXBT was an allegation based on his analysis and had not been independently verified by the bank or authorities when The Block published its report on November 3. The account thus combined the bank’s acknowledgment of an attack and fraudulent transactions with the absence of official confirmation of the funds the investigator said had been withdrawn.
The details of the case began with an alert about losses exceeding $106 million from multiple accounts at centralized exchanges, according to The Block’s account of ZachXBT’s findings. The alert said the funds were withdrawn on November 1 using USDC and USDT, while the alert was issued on November 2. The investigator then raised his estimate after tracing an additional $27 million in withdrawals, according to the report published on November 3. The report noted that some additional withdrawals took place after his initial alert, explaining why the estimate grew as tracking continued. The amount he later reported exceeded $133 million, while the value of losses attributed to the bank remained unconfirmed by the institution itself.
ZachXBT described a route that involved swapping USDC for ETH, then moving the funds to instant-swap services, including WellWallet and Kyrrex, and converting them to XMR through Wagyu. The report said the funds also moved across multiple chains, without implying that all the amounts followed the same route. These details show that the loss estimate was based on tracking transactions and conversions across more than one service and network, rather than on a comprehensive account statement disclosed by the bank. The Block quoted the investigator as saying the attack lasted several days, placing the withdrawals he tracked within activity that continued over time. ZachXBT also said the estimate of actual losses could rise if potential activity outside exchanges, including direct trading between parties, were taken into account.
ZachXBT’s analysis covered more than the value and route of the funds; he said he had “a high degree of confidence” that the attacker was not linked to North Korea’s Lazarus Group. The Block attributed this assessment to the investigator without presenting it as the result of an official investigation or independent confirmation of the attacker’s identity. The bank, meanwhile, said on November 4 that the cyberattack enabled fraudulent transactions and described the incident as under control. It also said the incident had no financial consequences for customers, while not confirming the reported amount. The attribution of losses exceeding $133 million and details about the perpetrator remained tied to ZachXBT’s analysis, rather than to a bank disclosure specifying the amounts or the attacker’s identity.
Crédit Mutuel Arkéa serves more than 5.6 million customers and has assets of 211.5 billion euros, according to figures cited by The Block in its report. The institution’s size places the case in a broader banking context than individual trading accounts, but those figures do not establish the amount of any loss to the bank or its customers. The bank confirmed an attack and fraudulent transactions, saying the incident was under control and customers had no financial impact. According to the coverage, it did not disclose the value of the losses ZachXBT attributed to it. The $133 million figure remains a reported estimate the bank has not confirmed, while the investigator’s assessment leaves open the possibility that actual losses could be higher if tracking includes trading activity outside exchanges.