TL;DR
- ZachXBT identified Crédit Mutuel Arkéa as the alleged victim of a crypto theft exceeding $133 million after tracing withdrawals from centralized exchange accounts.
- The investigator initially estimated more than $106 million stolen, then added $27 million in withdrawals and said losses could be higher with OTC activity.
- Crédit Mutuel Arkéa said fraudulent transactions occurred but customer interests remain protected, while investigators have not established how the attacker accessed exchange accounts.
Onchain investigator ZachXBT has identified French banking group Crédit Mutuel Arkéa as the alleged victim of a crypto theft exceeding $133 million, after tracing withdrawals from accounts at several centralized exchanges. In his Telegram update on November 3, ZachXBT said the attack unfolded over multiple days and could involve additional OTC activity. The bank’s connection to the theft originated from ZachXBT’s investigation, not from an official disclosure, while the case highlights risks around centralized crypto exchanges.
ZachXBT Traces More Than $133M Across Exchanges
ZachXBT first flagged more than $106 million in suspicious withdrawals on November 2 without naming the institution. He later identified over $27 million in additional exchange withdrawals across multiple platforms, lifting his estimate above $133 million, with some transfers occurring after his initial alert. The $133 million figure remains an investigative estimate rather than a confirmed final loss, extending an earlier onchain trail that had already raised the suspected theft above $133 million.
Blockchain analytics firm Bitquery traced $108.8 million in USDC withdrawn from accounts at Kraken, Crypto.com and OKX over roughly 21 hours on November 1 and 2. Much of the value was subsequently moved through hundreds of wallets and converted into ETH during the period, while Crypto.com said it blocked funds linked to the incident. The available evidence traces substantial exchange withdrawals but does not establish how the attacker obtained access, a distinction relevant to previous ZachXBT asset-freezing investigations.
Crédit Mutuel Arkéa later said fraudulent transactions had occurred and that the situation was under control, while stressing that clients faced no financial consequences and their interests remained protected. The bank did not disclose the amount involved or specify whether the stolen value originated as fiat currency or cryptocurrency at that stage. Its statement confirms an incident without validating every element of ZachXBT’s $133 million estimate, leaving the final financial impact unresolved as authorities and investigators continue assessing the case.
ZachXBT also said he has a high degree of confidence that North Korea’s Lazarus Group was not responsible, citing differences in laundering behavior. He described movements through instant exchanges, conversions into Monero and transfers across multiple chains, but the attacker’s identity remains unknown in his assessment. Attribution therefore remains open despite the expanding onchain trail, similar to other ZachXBT investigations involving stolen crypto and broader scrutiny of platforms linked to illicit crypto flows.
