ZachXBT names French bank Crédit Mutuel Arkéa as suspected victim of $133 million crypto theft

Prominent blockchain investigator ZachXBT has identified French banking group Crédit Mutuel Arkéa as the suspected victim of a cryptocurrency theft exceeding $133 million in a broadcast message on his Telegram channel earlier Wednesday.

ZachXBT first reported the theft on Monday, putting losses at more than $106 million. He later found another $27 million in withdrawals from centralized crypto exchanges — raising the total to more than $133 million — and stating the amount stolen could be higher once over-the-counter (OTC) trades are included.

Crédit Mutuel Arkéa confirmed the attack to CoinDesk on Wednesday, saying it had enabled fraudulent transactions but was now under control. The bank, which has over $250 billion in assets under management, did not disclose the amount stolen or whether the funds were originally held in traditional currency or cryptocurrency.

“This incident has no financial consequences for [our clients]. Their interests are fully protected,” a spokesperson said. The bank said it had temporarily suspended some transactions to prevent further losses and notified the relevant authorities. It is still assessing the attack’s consequences.

The bank has been preparing to enter the cryptocurrency business. In May, French financial newspaper L'Agefi reported that the bank had applied for a license under the EU's MiCA rules to offer crypto services to retail customers and other financial institutions.

According to blockchain analytics firm Bitquery, $108.8 million in USDC was withdrawn from accounts at Kraken, Crypto.com and OKX over 21 hours on November 1 and 2.

The firm traced the funds through hundreds of wallets, with much of the money converted into ether, which a central issuer cannot freeze.

Bitquery also identified a transfer of 396 ETH into a Kraken deposit address, though it did establish whether Kraken froze the funds or who controlled the receiving account.

Kraken and OKX did not immediately respond to a CoinDesk request for comment.

Crypto.com, however, confirmed it intervened. “We are aware of this report and have taken action to block funds linked to the incident from moving through Crypto.com. All user funds remain secure and accessible,” a spokesperson said.

The suspected breach follows several cryptocurrency thefts, including attacks on BTCPay Server and Brazil's Mercado Bitcoin, as well as the $6.3 billion Binance hack, which the FBI attributed to North Korean hackers.

As such, in the French bank’s case, ZachXBT said he had a “high degree of confidence” that North Korea's Lazarus Group did not carry out the latest attack, citing differences in how the stolen funds were moved.