ZachXBT Names French Bank Crédit Mutuel Arkéa as $133M Theft Victim

Onchain investigator ZachXBT has named French banking group Crédit Mutuel Arkéa as the alleged victim of a crypto theft exceeding $133 million. The claim surfaced on ZachXBT's X account Wednesday, November 4, 2026. The bank, described as holding $235 billion in assets, has not issued any official confirmation.

According to ZachXBT, the attack likely unfolded over multiple days, and actual losses could exceed what has already been reported. He pointed to over-the-counter, or OTC, transactions, direct asset swaps between parties outside public exchange order books, that weren't captured in earlier estimates and are harder to trace through standard onchain data.

"I suspect the amount stolen is larger when accounting for OTC activity," ZachXBT wrote, as quoted by Cointelegraph.

As of this writing, Crédit Mutuel Arkéa's involvement remains unverified by any independent party. Cointelegraph reached out to the bank for comment but had not received a response.

From $106 million to $133 million in three days

Loss estimates in this case climbed quickly once ZachXBT first flagged the activity. On Monday, he identified more than $106 million in suspicious withdrawals from several centralized exchanges. By Tuesday, that figure was revised past $133 million after another $27 million in withdrawals surfaced, some of which occurred even after his initial warning went public.

By Wednesday, ZachXBT had named Crédit Mutuel Arkéa as the alleged victim. He also suggested the total could climb further, given the pattern of rising estimates since Monday.

Decrypt reported that ZachXBT accused the theft of being "covered up." He claimed the lack of disclosure from relevant parties allowed more than $30 million to be laundered before any adequate public warning was issued. That allegation adds a new dimension to the case: it's not just about the size of the theft, but about a delayed response that gave the perpetrator room to hide the money trail.

Tracing the funds: stablecoins into Ether in four hours

Blockchain analytics firm Bitquery had already traced withdrawals from accounts across three exchanges: Kraken, Crypto.com, and OKX. Bitquery found that roughly $63 million in stablecoins were converted into Ether (ETH) within just four hours.

That kind of rapid conversion is common when crypto thieves try to move stolen funds into a more liquid asset that's easier to split across many wallet addresses, before cashing out through other channels such as OTC desks or exchanges with looser oversight. The speed of these conversions is one reason investigators like ZachXBT and analytics firms like Bitquery rely on real-time onchain data rather than waiting for official disclosures from victims.

Kraken and Crypto.com, two of the three exchanges flagged in Bitquery's tracing, subsequently confirmed to Cointelegraph that they had restricted accounts or blocked funds linked to the suspected theft. Both platforms said their own systems remained secure, meaning the breach involved compromised access to victim funds rather than exchange infrastructure itself. OKX has not been reported making a similar statement so far.

Crédit Mutuel Arkéa, a bank with $235 billion in assets

ZachXBT described Crédit Mutuel Arkéa as an institution holding $235 billion in assets. That scale means an alleged $133 million theft, while substantial in absolute terms, represents only a small fraction of the bank's total holdings.

ZachXBT has not yet disclosed how attackers gained access to the funds. Whether it involved a compromised private key, a flaw in custody systems, or some other route remains unanswered in the reporting available so far.

Not Lazarus Group, ZachXBT says

The Block reported that ZachXBT said he has a "high degree of confidence" the attacker behind this theft is not associated with North Korea's Lazarus Group, the hacking collective frequently linked to large-scale crypto heists worldwide.

That distinction matters given a recurring pattern of accusations lately. Cointelegraph noted that North Korea had previously denied any role in the $6.3 billion Binance hack, instead pointing the finger at the United States. By explicitly ruling out Lazarus Group in the Crédit Mutuel Arkéa case, ZachXBT's assessment points toward a different, so far unidentified group or individual.

The case also emerged shortly after the hack at Brazil's Mercado Bitcoin, which lost roughly $40 million to $46 million. Both incidents involve financial institutions tied to crypto assets, though nothing in the available reporting suggests the two are connected.

What it means for traders

The case hasn't moved prices for major crypto assets, but there are concrete things worth watching over the coming days.

First, keep an eye on whether Crédit Mutuel Arkéa issues an official statement. Confirmation or denial from the bank will determine whether this grows into a broader regulatory conversation around crypto custody at European financial institutions, or fades as an unproven allegation.

Second, watch for continued movement from the addresses ZachXBT has already flagged. A fresh wave of large conversions into ETH or other assets would signal ongoing laundering, following the same pattern that pushed loss estimates from $106 million to $133 million in just three days.

Third, follow-up responses from Kraken, Crypto.com, and OKX serve as a key indicator. More frozen accounts or blocked funds would mean tighter pressure on exit routes for the stolen assets, potentially complicating the attacker's ability to cash out into liquid holdings or fiat.

Fourth, this case adds to a string of major crypto security incidents in recent weeks, including the Mercado Bitcoin hack in Brazil. Repeated incidents like this tend to reignite discussions around custody regulation, particularly for traditional financial institutions now holding or managing crypto at scale.

Who is ZachXBT and why does his report carry weight?

ZachXBT is a pseudonymous onchain investigator whose findings on the Crédit Mutuel Arkéa case were picked up by Cointelegraph, CoinDesk, Decrypt, and The Block. The bank itself has not officially confirmed its involvement.

How much was allegedly stolen from Crédit Mutuel Arkéa?

ZachXBT estimated losses at more than $133 million as of Wednesday, up from an initial $106 million flagged Monday after another $27 million in withdrawals surfaced Tuesday. He believes the real figure could be higher once OTC activity is included.

Are the exchanges involved responsible for the theft?

Not based on current reporting. Kraken and Crypto.com told Cointelegraph they restricted accounts or blocked funds linked to the suspected theft and said their own platforms remain secure. Funds traced so far moved through user accounts on Kraken, Crypto.com, and OKX, not exchange infrastructure itself.