ZachXBT puts alleged Crédit Mutuel Arkéa theft above $133 million

What it is

ZachXBT, an onchain investigator, alleges that Crédit Mutuel Arkéa, a French cooperative bank with more than 5.6 million customers and €211.5 billion in assets (about $237 billion), lost over $133 million in USDC and USDT. ZachXBT named the bank on 3 November 2026. The bank had made no public statement as of 4 November 2026. The loss figure, tracing and attribution all rest on ZachXBT's analysis, with no confirmation from the bank or authorities.

How it works

ZachXBT's first report, published 2 November 2026, described an unidentified EU entity and put losses above $106 million. Withdrawals from several centralized exchange accounts had happened the day before. ZachXBT then traced a further $27 million, some of it moved after the first report, which brought the estimate above $133 million.

The attack ran for several days. The attacker swapped USDC to ETH quickly, used the instant exchanges WellWallet and Kyrrex, converted funds to Monero through Wagyu, and moved assets between chains over bridges. The page does not say how the attacker gained access to the exchange accounts.

Caveats

• ZachXBT's estimate may exclude losses from over-the-counter activity, so the total could be higher.
• ZachXBT says, with "high degree of confidence", that the attacker is not linked to North Korea's Lazarus Group. This is the investigator's own attribution, not an official finding.
• ZachXBT alleges that delayed disclosure let more than $30 million be laundered, and that prompt notice to EU law enforcement could have allowed the funds to be frozen.
• Kraken restricted associated accounts and said neither its systems nor its customer accounts were compromised. Crypto.com blocked related funds. OKX began reviewing the allegations.