Onchain investigator ZachXBT has alleged that the European financial institution he says lost more than $133 million in a suspected crypto drain is Crédit Mutuel Arkéa, a French banking group.

In an update posted to his Telegram channel, ZachXBT wrote that the victim “is allegedly Credit Mutuel Arkea, a French bank with $235B in assets.” He added that “the attack on the bank occurred for multiple days,” and said he suspects “the amount stolen is larger when accounting for OTC activity,” a reference to over-the-counter trades that settle away from public order books. Crédit Mutuel Arkéa did not immediately respond to a request for comment from Unchained.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

Why It Matters

If the allegation holds, a regulated European bank, not a crypto-native firm, would sit at the center of a nine-figure crypto theft drawn from its own accounts at centralized exchanges. It would also put a spotlight on when a bank holding funds at crypto exchanges is expected to tell the public it was hit, the question ZachXBT raised in his Nov. 3 update, when he said the lack of a “proper incident disclosure” let more than $30 million be laundered.

From ‘EU Entity’ to a Named Bank

The naming is the third step in a thread ZachXBT started on Nov. 2, when he flagged $106 million pulled on Nov. 1 from an unnamed EU entity’s accounts at several centralized exchanges, in USDC and USDT. He said then he was highly confident the thief was not North Korea’s Lazarus Group, pointing to how the funds were being laundered.

A day later he had traced another $27 million in exchange withdrawals and raised his tally to $133 million, writing that his working theory was a large Western European financial institution and suggesting the loss was being kept quiet. He has argued that the silence let the attacker launder more than $30 million before anyone could move to freeze it. Per his earlier posts, the stablecoins were swapped into ETH, run through instant exchange services, partly converted to Monero and bridged across chains.

Kraken and Crypto.com, two of the exchanges the withdrawals were traced to, have since restricted accounts or blocked funds tied to the theft, according to statements they gave Cointelegraph.

Related Listen: Is THORChain a Money Laundering Service? A Chinese Crime Boss Says Yes