Breaking: ZachXBT Names French Bank Crédit Mutuel Arkéa in Alleged $133M Crypto Theft — Bank Has Not Confirmed

UPDATE — November 4, 2026: Crédit Mutuel Arkéa has now confirmed the attack. In a statement reported by CoinDesk and Ledger Insights on November 4, the bank confirmed an attack that enabled fraudulent transactions, said the incident is now under control, noted that some transactions have been temporarily suspended, and said the relevant authorities have been notified. The bank's statement: "This incident has no financial consequences for [our clients]. Their interests are fully protected." The bank did NOT disclose the amount stolen, or whether the funds were originally fiat or crypto — so the money figures below still stand as sourced: ZachXBT's estimate of more than $133 million, and Bitquery's independently traced $108.8 million. What changed is the victim's name: it is no longer one investigator's allegation.

A theft north of $100 million is not a rumor — the money trail is on-chain. What is not confirmed is whose money it was. On the evening of November 3, on-chain investigator ZachXBT named French banking group Crédit Mutuel Arkéa as the alleged victim of a crypto theft he now puts at more than $133 million. The bank has issued no public statement confirming or denying that, and neither The Block nor Cointelegraph could get a response from it. So read this the way we wrote it: the theft is traced, the total is an estimate, and the victim's name is one investigator's allegation — for now.

What happened

On Sunday, November 1, money started leaving accounts at three exchanges — Kraken, Crypto.com and OKX — as USDC, over roughly 21 hours. Blockchain analytics firm Bitquery followed that money on Ethereum and counted $108.8 million withdrawn to 15 wallets. Kraken accounted for about 95% of the total it traced. Eleven of those 15 wallets had previously been paid by those same exchanges, which points to the thief holding working logins and wallet keys — a compromised device or an insider; the chain alone cannot distinguish the two, and there is no sign the exchanges themselves were breached.

ZachXBT first flagged the theft on November 2 at more than $106 million, drawn from multiple centralized-exchange accounts in USDC and USDT. On November 3 he raised the estimate past $133 million — some withdrawals continued even after his first disclosure — and named Crédit Mutuel Arkéa as the alleged source of the funds. Arkéa is a major French cooperative banking group: roughly €211.5 billion in assets (about $237 billion) and more than 5.6 million customers. If the identification holds, this is not a DeFi exploit at all — it is a nine-figure theft out of accounts belonging to a regulated European bank, moved through ordinary exchange withdrawals.

Where the money went

Of the traced funds, $62.98 million was swapped into 27,553 ETH through UniswapX inside about four hours — the classic first laundering step, out of freezable stablecoins and into an asset no issuer can claw back. ZachXBT's tracing adds the rest of the pattern: USDC-to-ETH swaps, instant exchanges, Monero, and cross-chain bridges. As of 13:27 UTC on November 3, about $61 million still sat on Ethereum in thief-linked addresses, per Bitquery. On the freeze ledger, Tether froze 1.14 million USDT; Circle froze none of the 2.53 million USDC still sitting in the traced wallets. ZachXBT also criticised the slow disclosure, arguing $30 million or more could have been frozen by EU law enforcement had the alarm gone out sooner.

Two exchanges have, in effect, confirmed a theft touched their platforms: Kraken and Crypto.com both told Cointelegraph they restricted accounts or blocked funds tied to the suspected theft, and both said their own platforms remained secure. Cointelegraph adds that losses may extend beyond the traced total if over-the-counter (OTC) desk activity is involved, and the attack vector itself has not been disclosed.

What's confirmed, what's not

Traced on-chain (Bitquery, independent of ZachXBT): $108.8 million in USDC leaving Kraken, Crypto.com and OKX accounts on Nov 1–2 to 15 wallets; $62.98 million swapped to ETH; Tether's 1.14 million USDT freeze. Corroborated by the exchanges: Kraken and Crypto.com restricted accounts and blocked funds tied to a suspected theft; their platforms were not breached. Confirmed by the bank (November 4): Crédit Mutuel Arkéa confirmed it was hit by an attack enabling fraudulent transactions, now under control, with some transactions temporarily suspended and authorities notified; the bank says its clients face no financial consequences and their interests are fully protected. Still not disclosed by the bank: the amount, and whether the funds were originally fiat or crypto — the $133 million-plus total remains ZachXBT's estimate, and Bitquery, which traced the money independently, could not name the victim from the chain and leaned toward a trading or payments business rather than a bank; the bank's own confirmation settles the identity, not the numbers. ZachXBT also says he has high confidence this is NOT the Lazarus Group, the North Korean state hackers behind the largest thefts on record — which, if right, makes this a financially motivated crew pulling off a bank-sized score.

The BogusAPY read

File this one next to tomorrow's list of the year's biggest hacks, because it makes the same point from the other end of the market: the weakest link was not a smart contract. Nobody broke Kraken. The money walked out through working credentials, in plain withdrawals, over 21 hours — and most of it is now in ETH and Monero, beyond any freeze. A regulated bank's operational security, not DeFi code, is the alleged failure here. When a platform quotes you an APY, the number that matters is the one nobody prints: who can move the money, and how fast anyone would notice.

Get posts like this by email: Subscribe to BogusAPY

Follow BogusAPY on X: @BogusAPY

Sources: The Block and Cointelegraph (Nov 3–4, 2026) reporting ZachXBT's disclosure; Bitquery Research on-chain trace (Nov 3, 2026). The $133 million figure is ZachXBT's estimate; the traced-withdrawal figures are Bitquery's. Crédit Mutuel Arkéa confirmed the attack on November 4, 2026 (via CoinDesk and Ledger Insights) without disclosing an amount. This post will be updated if the bank or EU authorities disclose figures, or if freeze totals move materially. Not financial advice.