USD
ZachXBT Links French Bank Crédit Mutuel Arkéa to Alleged $133M-Plus Crypto Theft
Investigator traces suspicious exchange withdrawals as allegations of delayed disclosure and money laundering emerge
TL;DR
- Onchain investigator ZachXBT identified French banking group Crédit Mutuel Arkéa as the alleged victim of a crypto theft exceeding $133 million.
- The suspected attack spanned several days, with stolen funds reportedly moved through crypto exchanges, cross-chain transfers and Monero conversions.
- ZachXBT accused the institution of delayed incident disclosure and said the attacker was unlikely to be linked to North Korea's Lazarus Group. The bank has not confirmed the allegations.
Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.
Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!
Onchain investigator ZachXBT identified French cooperative banking group Crédit Mutuel Arkéa on November 3, 2026, as the alleged victim of a cryptocurrency theft exceeding $133 million. The suspected attack involved unauthorized withdrawals from multiple centralized exchange accounts over several days, with ZachXBT warning that the total losses could be higher. The bank has not publicly confirmed or denied the incident, and the allegations have not been independently verified by the institution or authorities.
How ZachXBT Traced the Alleged Theft to Crédit Mutuel Arkéa
ZachXBT first flagged the suspicious activity on November 2, saying an unidentified European Union entity had suffered substantial losses from accounts held at several cryptocurrency exchanges. He subsequently identified additional withdrawals and suggested that the affected organization was a major financial institution in Western Europe.
The investigator's findings developed as follows:
Before publicly naming the bank, ZachXBT outlined his working theory on Telegram.
"My working theory is a large financial institution in Western Europe was exploited and it's currently being covered up," he wrote.
Later that Tuesday, ZachXBT explicitly identified Crédit Mutuel Arkéa as the suspected victim, while warning that the estimated losses might not account for all activity.
"Disclosing the EU financial institution exploited for $133M+ is allegedly Credit Mutuel Arkea, a French bank with $235B in assets," he wrote. "The attack on the bank occurred for multiple days. I suspect the amount stolen is larger when accounting for OTC activity."
The reference to OTC activity concerned possible over-the-counter transactions that could increase the estimated losses. ZachXBT also published four Ethereum addresses he said were connected to the suspected theft. He did not explain how he identified the bank or how the attacker allegedly gained access to its exchange accounts.
Stolen Stablecoins Reportedly Moved Through Exchanges and Monero
According to ZachXBT, the suspected attacker withdrew funds in USD Coin (USDC) and Tether (USDT) before moving the assets through a series of cryptocurrency transactions. His tracing showed USDC being exchanged for Ethereum (ETH), funds being transferred through instant exchange services, and some assets being converted into Monero (XMR).
"Over the past 24 hours the illicit actor has been aggressively swapping USDC for ETH, transferring to instant exchanges (WellWallet, Kyrrex, etc), converting to XMR via Wagyu, and bridging across multiple chains," ZachXBT wrote in his original Telegram disclosure.
The investigator also accused the affected institution of failing to conduct "proper incident disclosure," alleging that delayed reporting allowed more than $30 million in stolen funds to be laundered. He argued that promptly alerting EU law enforcement could have enabled authorities to freeze the assets.
The allegations surfaced shortly after Binance suffered a separate $6.3 billion hack, described as the largest cryptocurrency theft on record. The FBI attributed that incident to North Korean hackers, but ZachXBT drew a distinction between the Binance attack and the suspected European banking theft.
He said the attacker behind the latter incident remained unidentified, but stated that "with a high degree of confidence it is NOT Lazarus Group," citing his assessment "based on multiple laundering indicators." Lazarus Group is a North Korean hacking collective.
French Bank Has Not Confirmed Allegations
Crédit Mutuel Arkéa has not publicly confirmed or denied the alleged cryptocurrency theft.
The allegations remain based on ZachXBT's onchain investigation rather than independent confirmation from Crédit Mutuel Arkéa or the relevant authorities.
The French cooperative banking group serves more than 5.6 million customers and holds total assets of 211.5 billion euros, equivalent to approximately $237 billion.
The institution had also been preparing to expand into cryptocurrency services. French financial newspaper L'Agefi reported in May that Crédit Mutuel Arkéa had applied for authorization under the European Union's Markets in Crypto-Assets (MiCA) framework.
The application was intended to support cryptocurrency services for retail banking customers and enable the bank to offer similar services through its Arkéa Banking Services division under a white-label arrangement.
This article has been refined and enhanced by ChatGPT.
