ZachXBT names Crédit Mutuel Arkéa in alleged $133m crypto theft

What happened

Onchain investigator ZachXBT has publicly identified Crédit Mutuel Arkéa as the alleged victim of a cryptocurrency theft exceeding $133 million, according to reports from Decrypt and Blockonomi. The French cooperative bank has not publicly confirmed or denied the incident, and the allegation has not been independently verified by the bank or authorities. Decrypt reported that ZachXBT made the disclosure on his Telegram channel; Blockonomi said he named the institution on the evening of Nov. 3.

The case first surfaced without the bank being named. ZachXBT initially reported on Nov. 2 that an unnamed entity in the European Union had lost more than $106 million from accounts at several centralized crypto exchanges, with the withdrawals taking place the previous day. He said the money was taken in USDC and USDT. The attacker then swapped USDC for ETH, moved assets through instant exchanges, converted some funds into the privacy coin Monero and bridged them across multiple blockchains, according to the reports.

A day later, ZachXBT raised his estimate. He said he had traced an additional $27 million in exchange withdrawals, including some that occurred after his first public post, bringing the alleged total to more than $133 million. He also published four Ethereum addresses that he linked to the theft. According to Decrypt, he said the attack on the bank lasted for multiple days and that he suspects the amount stolen is larger once over-the-counter activity is taken into account.

Why it matters

The allegation puts attention on how quickly large crypto losses can move across exchanges, bridges and privacy-focused assets, and on whether victims and intermediaries disclose incidents fast enough for funds to be frozen. ZachXBT alleged that the institution did not conduct proper incident disclosure and that earlier notification to EU law enforcement could have allowed some $30 million to be frozen. The reports also note that Crédit Mutuel Arkéa has been preparing to offer crypto services, a plan that gives the case added significance for a bank moving into the sector.

What the data shows

The public figures in the case have shifted as ZachXBT has posted updates. His initial estimate was more than $106 million in withdrawals from exchange accounts on Nov. 1. He later added $27 million, taking the alleged total above $133 million. He identified four Ethereum addresses as linked to the activity. The reports also cite his claim that about $30 million could have been frozen with earlier disclosure. Crédit Mutuel Arkéa's reported customer base is more than 5.6 million.

Background

Crédit Mutuel Arkéa is a French mutual banking group with more than 5.6 million customers, according to Blockonomi, which reported total assets of €211.5 billion, or about $237 billion. Decrypt described the bank as having $235 billion in assets. In May, French financial newspaper L'Agefi reported that the group had applied for a license under MiCA, the EU's crypto rulebook, to serve retail customers and to provide white-label services through its Arkéa Banking Services division. The reports also place the allegation days after the $6.3 billion hack of Binance, the largest crypto theft on record, which the FBI has attributed to North Korean hackers.

What is still unclear

Several central questions remain unanswered. The bank has not issued a public statement, and neither the bank nor authorities have independently verified ZachXBT's attribution. He did not say how he identified Crédit Mutuel Arkéa or how the attacker gained access to the exchange accounts. The attacker remains unidentified. It is also unclear whether the alleged total will rise further, as ZachXBT has said possible over-the-counter activity could add to the losses.

What to watch

Further comment from Crédit Mutuel Arkéa would clarify whether it accepts the allegation. Also worth watching is whether EU law enforcement or crypto exchanges announce freezes or investigations, and whether the bank's MiCA application proceeds as planned. Onchain analysts will continue to monitor the four Ethereum addresses and any further movement of funds into Monero or across bridges. The reports do not indicate that any arrests or formal charges have been announced.

Questions readers ask