Key Highlights
- On-chain investigator ZachXBT named French cooperative bank Crédit Mutuel Arkéa, which manages roughly $235 billion in assets, as the alleged victim of a crypto theft exceeding $133 million, after initially reporting that an unnamed EU entity had lost over $106 million.
- Blockchain analytics firm Bitquery independently traced about $108.8 million in USDC withdrawals from Kraken, Crypto.com, and OKX accounts over roughly 21 hours.
- ZachXBT said he was highly confident the perpetrator was not linked to North Korea’s Lazarus Group, and noted that the lack of prompt public disclosure allowed more than $30 million to be laundered that EU law enforcement might otherwise have frozen.
On-chain investigator ZachXBT has finally revealed a French cooperative bank, Crédit Mutuel Arkéa, as the alleged victim of a cryptocurrency-related theft exceeding $133 million. The bank, which manages approximately $235 billion in assets, was identified in an update on November 4, 2026, after days of tracing withdrawals from centralized exchange accounts.
ZachXBT stated the attack spanned several days and that total losses could be higher once over-the-counter activity is factored in.
Crédit Mutuel Arkéa Reportedly Suffers Cyber Attack
ZachXBT first reported the incident on November 2. He described an unnamed European Union entity that had lost more than $106 million the previous day from multiple accounts on centralized exchanges. The funds were withdrawn primarily as USDC and USDT stablecoins.
The following day, he raised the estimate above $133 million after identifying an additional $27 million in withdrawals. Some of those transfers occurred after his initial public alert. He initially described the victim as a large financial institution in Western Europe and suggested the matter was being handled quietly.
By the evening of November 3 into November 4, ZachXBT named Crédit Mutuel Arkéa specifically. Blockchain analytics firm Bitquery independently traced about $108.8 million in USDC withdrawals from accounts at Kraken, Crypto.com, and OKX over roughly 21 hours spanning November 1 and 2.
How the Funds Moved
The attacker moved quickly to obscure the trail. Large portions of the stablecoins were swapped into Ether, with reports indicating roughly $63 million converted into more than 27,000 ETH within about four hours. Funds then flowed through instant-exchange services such as WellWallet and Kyrrex, were partially converted to the privacy coin Monero via services like Wagyu, and were bridged across multiple chains.
ZachXBT expressed a high degree of confidence that the perpetrator was not linked to North Korea’s Lazarus Group, based on the laundering patterns observed. He also noted that the absence of prompt public disclosure allowed more than $30 million to be laundered that European law enforcement might otherwise have been able to freeze.
Exchanges including Kraken and Crypto.com later restricted or blocked associated accounts and stated that their platforms themselves were not compromised and that customer funds remained secure.
Bank Status and Response
Crédit Mutuel Arkéa is a major French cooperative banking group. Some reports indicate the bank acknowledged to media outlets that it had experienced fraudulent transactions that were brought under control, with no financial impact on clients. However, it has not publicly detailed the exact amount involved or confirmed the full scope of ZachXBT’s findings in an official statement as of the latest updates.
The incident highlights ongoing risks for traditional financial institutions that maintain accounts or exposure on cryptocurrency exchanges. Access methods used by the attackers have not been publicly detailed.
This case adds to a series of significant security incidents involving large sums moving through crypto infrastructure in late 2026, such as Binance and CoinDCX. Rapid conversion to ETH and privacy tools underscores challenges in freezing assets once they leave regulated platforms. Investigators and exchanges continue monitoring related addresses, while the full extent of any OTC component remains unclear.
