The blockchain investigator ZachXBT has put the loss from an attack on the French bank Crédit Mutuel Arkéa at more than $133 million, and the bank has confirmed an attack without giving a figure. CoinDesk and The Block both report the claim, and both say the amount is unverified.
ZachXBT first flagged an unnamed EU entity on 2 November, saying it had lost more than $106 million from accounts at several exchanges. He later traced about $27 million more in withdrawals, and named the bank in a Telegram post on 3 November. He says losses could be higher once over-the-counter trades are counted.
Analytics firm Bitquery, cited by CoinDesk, counted $108.8 million in USDC withdrawn from Kraken, Crypto.com and OKX accounts over 21 hours on 1 and 2 November. The money passed through hundreds of wallets, much of it into ether, and some went on to Monero, which no issuer can freeze. Crypto.com said it had blocked funds linked to the incident.
On Wednesday the bank told CoinDesk the attack had allowed fraudulent transactions but was under control. It said it had suspended some transactions, told the authorities, and that the incident had no financial consequences for clients.
ZachXBT said he has a high degree of confidence the attacker is not North Korea’s Lazarus Group. He also alleges the bank let more than $30 million be laundered, a claim The Block could not verify.
The bank has not said what was taken, whether it was crypto or fiat, or how the attacker got in. Kraken and OKX did not respond to CoinDesk, so whether any funds were frozen is unknown.
