Estimated losses from a crypto breach targeting a European banking group have escalated further. On-chain sleuth ZachXBT has identified Crédit Mutuel Arkéa, a French banking group holding $235 billion in assets, as the victim of a crypto theft with losses exceeding $133 million.
The $133 million figure updates an initial estimate of $106 million reported the previous Monday. Losses surged after ZachXBT detected an additional $27 million in illicit withdrawals. Some of those follow-up transactions took place even after initial warnings were shared with the public.
The total asset loss is not expected to have reached its final tally. ZachXBT noted that the total stolen amount could rise even higher when factoring in over-the-counter (OTC) transactions - direct asset trades settled off public exchanges - that were not captured in the initial analysis. What makes the incident particularly notable is not just its sheer scale, but the routes used to move the funds out.
How Tens of Millions in Funds Were Moved
The fund trail began unraveling as the assets were channeled through centralized crypto exchanges. According to tracking conducted by blockchain analytics firm Bitquery, withdrawal flows were detected originating from exchange accounts at Kraken, Crypto.com, and OKX. Across these three platforms, roughly $63 million in stablecoins were swiftly converted into Ether (ETH) within a four-hour window.
Responding to suspicious activity on their systems, Kraken and Crypto.com confirmed they have restricted the affected accounts and frozen a portion of the funds linked to the incident. Representatives from both exchanges emphasized that their internal infrastructure suffered no security breach.
The Undisclosed Exploit
Although the asset conversion flows have been mapped out by on-chain analysts, the initial entry point of the breach remains an open question. As of the time of reporting, Crédit Mutuel Arkéa has not issued an open confirmation. The penetration method used by the attackers to access the French bank’s crypto accounts also remains undisclosed.
For market participants closely watching institutional crypto adoption, two pressing questions now surround Arkéa: what vulnerability did the attackers exploit to infiltrate the institutional accounts, and what will the final loss figure be once all OTC transactions are fully traced?
Reported via Cointelegraph.
Previously: EU Entity Reportedly Breached for Over $106M - Hacker Moves Stablecoins to Ethereum and Monero
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
