ZachXBT Names Crédit Mutuel Arkéa in $133M Crypto Theft

Crédit Mutuel Arkéa Named as Victim

On-chain investigator ZachXBT has identified French banking group Crédit Mutuel Arkéa as the alleged victim of a crypto theft exceeding $133 million, and he cautioned on Wednesday that the real total is likely higher. The pseudonymous sleuth, known for tracing stolen funds and pressing exchanges to freeze them, described the target as a banking group holding roughly $235 billion in assets and said it was allegedly exploited over multiple days rather than in a single sweep. A share of the missing money, he noted, moved through over-the-counter channels, where a market-maker takes the opposite side of large off-exchange trades, and that OTC activity was left out of earlier estimates. He said he suspects the amount stolen is larger once those flows are counted, which means the loss figure could climb above anything measurable on-chain.

The estimate has moved twice in three days. On Monday, ZachXBT first flagged more than $106 million in suspicious withdrawals leaving accounts at centralized exchanges. By Tuesday, he had raised the figure to above $133 million after tracing an additional $27 million in withdrawals, part of which left after his initial warning had already been published. The bank's alleged involvement has not been independently verified, and as of Wednesday no statement from the bank or French authorities had been confirmed. The investigator has also not disclosed how the attackers gained access to the funds, leaving the root cause open.

Stablecoins Converted to Ether and Monero

The trail itself is well mapped. On-chain analysis traced the suspicious withdrawals to accounts at Kraken, Crypto.com and OKX, and shows approximately $63 million in stablecoins converted into Ether (ETH) inside a four-hour window. A conversion of that size normally produces measurable slippage on thinner venues, since order books cannot absorb such volume without the price moving against the seller, which is why transfers at this scale are typically split or routed through OTC desks. The suspected attackers withdrew funds in USDC and USDT, swapped them into Ethereum and Monero (XMR), a privacy coin that conceals sender, receiver and amount, and moved value across multiple blockchains in successive hops rather than through a single atomic swap between two chains. Each hop between assets and chains narrows what investigators can tie back to the original withdrawals. ZachXBT observed that the fund movement does not match the typical methods of North Korea's Lazarus Group, the hacking collective blamed for many of the largest crypto thefts on record, which leaves attribution unresolved for now.

Exchange responses have started to land. Kraken and Crypto.com have since restricted accounts or blocked funds associated with the suspected theft, and both exchanges said their platforms remained secure. ZachXBT further argued that because the incident was not properly disclosed in time, more than $30 million had already been run through laundering before European Union investigators had any opportunity to seek freezes.

A Freeze Window That Closed Early

Two details in the on-chain record matter more than the headline figure. First, $27 million left after the initial warning was already public, and the $30 million laundering estimate indicates the window for EU investigators to freeze assets closed before they could act; in theft recovery, disclosure speed rather than detection decides how much is clawed back. Second, the mismatch with Lazarus Group methods keeps attribution open, and the Monero conversion will make every downstream hop harder to follow. The root cause is still unknown: neither the bank nor the investigator has explained how access was gained. Until a post-mortem or an official statement arrives, the $133 million figure should be read as a floor, not a final number.