Key facts
- ZachXBT said Crédit Mutuel Arkéa, which he described as holding $235 billion in assets, was allegedly exploited over multiple days.
- On Monday ZachXBT identified over $106 million in suspicious withdrawals from centralized exchanges; on Tuesday the estimate rose to more than $133 million.
- Bitquery traced withdrawals to accounts at Kraken, Crypto.com and OKX and found roughly $63 million in stablecoins converted into ether within four hours.
- Kraken and Crypto.com said they restricted accounts or blocked funds tied to the suspected theft, and both said their platforms remained secure.
- Crédit Mutuel Arkéa had not responded to a request for comment at the time of Cointelegraph's report.
Onchain investigator ZachXBT said on Wednesday, November 4, 2026, that French banking group Crédit Mutuel Arkéa was the alleged victim of a crypto theft exceeding $133 million, warning that total losses could be higher. He described the institution as holding $235 billion in assets and said it was allegedly exploited over multiple days, Cointelegraph reported.
ZachXBT said additional losses may have occurred through over-the-counter transactions not included in earlier estimates. "I suspect the amount stolen is larger when accounting for OTC activity," he said. The bank's alleged involvement has not been independently verified, and ZachXBT has not disclosed how the attackers gained access to the funds. Crédit Mutuel Arkéa did not respond to a request for comment before publication.
The disclosure follows ZachXBT's initial report on Monday, when he identified over $106 million in suspicious withdrawals from centralized exchanges. On Tuesday he raised the estimate to over $133 million after finding another $27 million in withdrawals, some of which occurred after his first warning.
Blockchain analytics firm Bitquery previously traced the withdrawals to accounts at Kraken, Crypto.com and OKX, and found that approximately $63 million in stablecoins had been converted into ether within four hours. Kraken and Crypto.com told Cointelegraph they had restricted accounts or blocked funds tied to the suspected theft, and both said their platforms remained secure.