Prominent blockchain investigator ZachXBT has named French banking group Crédit Mutuel Arkéa as the alleged victim of a cryptocurrency theft exceeding $133 million. The funds were withdrawn from accounts at multiple centralized exchanges over several days beginning around November 1.

ZachXBT initially reported an unnamed European Union entity had lost more than $106 million in USDC and USDT withdrawals from exchange accounts. Subsequent tracing identified an additional $27 million in withdrawals, some occurring after the first public alert, pushing the on-chain total above $133 million. The investigator stated the attack spanned multiple days and that the true figure may be higher once over-the-counter activity is included.

Crédit Mutuel Arkéa, a cooperative banking group, has assets reported at approximately $235 billion. In response to inquiries, the bank confirmed an incident involving fraudulent transactions that has since been brought under control. A spokesperson stated the matter carries no financial consequences for clients and that their interests remain fully protected. The bank did not disclose the precise amount involved or confirm whether the original holdings were in traditional currency or digital assets.

Fund Movements and Laundering Path

Blockchain analytics showed roughly $108.8 million in USDC leaving accounts at Kraken, Crypto.com and OKX across a roughly 21-hour window on November 1 and 2. Significant portions of the stablecoins were rapidly swapped for ether. Within hours, tens of millions of dollars in value had been converted into ETH. The attacker then routed assets through instant exchange services, converted some holdings into the privacy-focused cryptocurrency Monero, and bridged funds across multiple blockchains.

Exchanges including Kraken and Crypto.com later restricted or blocked accounts and funds linked to the activity while affirming that their platforms themselves remained secure. ZachXBT expressed a high degree of confidence that the perpetrator was not North Korea’s Lazarus Group, citing distinctive laundering patterns that differed from those typically associated with the group.

The investigator criticized the absence of prompt public disclosure, arguing that the delay prevented law enforcement from freezing more than $30 million in stolen assets that were subsequently moved. Some reporting has suggested the operation involved bank transfers from the group’s online banking arm, Fortuneo, into exchange accounts opened under false identities, after which the funds were converted into stablecoins and withdrawn.

Bank’s Crypto Ambitions and Timeline

Crédit Mutuel Arkéa has been preparing to expand into cryptocurrency services. Earlier in the year it applied for authorization under the European Union’s Markets in Crypto-Assets regulation to offer digital asset products to retail customers and to provide white-label services through its banking division.

The sequence of events unfolded over several days. The first public alert came early in the week with the $106 million figure. Updated figures and the naming of the bank followed on subsequent days. As of the latest statements, the bank maintains that client funds are safeguarded and that the fraudulent activity has been contained.

Details on precisely how access to the exchange accounts was obtained remain undisclosed by both the investigator and the bank. On-chain addresses linked to the activity have been published, and monitoring of further movements continues.