ZachXBT names Crédit Mutuel Arkéa in alleged $133M crypto theft

By Tom Whitfield

On Wednesday, onchain investigator ZachXBT identified Crédit Mutuel Arkéa as the alleged victim of a crypto theft exceeding $133 million. Kraken and Crypto.com have also restricted accounts or blocked funds tied to the suspected theft.

The pseudonymous investigator described the French banking group as having $235 billion in assets and alleged that attackers exploited it over multiple days. The attribution remains unverified, and the bank has not confirmed the allegation.

The $235 billion figure describes the institution’s size as characterized by ZachXBT, not the value exposed in the incident. The reported theft should not be inferred from the bank’s total assets without bank confirmation or transaction-level ownership evidence.

What does the withdrawal timeline show?

On Monday, ZachXBT identified more than $106 million in suspicious withdrawals from centralized exchanges. On Tuesday, he found another $27 million in withdrawals and raised estimated losses to more than $133 million.

Some of the additional withdrawals occurred after his initial warning. The $27 million addition expanded both the transaction count and the period covered by ZachXBT’s estimate.

The increase amounted to roughly one quarter of the Monday estimate, making the revision substantial rather than a rounding adjustment. Because some added withdrawals followed the first warning, his figures described an incident whose transaction count was still expanding.

How did the funds move?

Bitquery traced withdrawals from accounts at Kraken, Crypto.com and OKX. Its analysis found that approximately $63 million in stablecoins converted into Ether (ETH) within four hours.

The four-hour sequence gives compliance teams a defined period for matching exchange outflows against onchain conversion activity. It also documents a rapid shift from exchange balances into Ether’s public blockchain.

How could the loss total be higher?

ZachXBT said: “I suspect the amount stolen is larger when accounting for OTC activity.” His statement points to over-the-counter transactions excluded from earlier estimates, but the disclosure does not identify specific transactions or their amounts.

If Crédit Mutuel Arkéa confirms ownership of the affected funds, loss reconciliation would require tracing those flows before the $133 million estimate can be treated as a final total. The current figure does not capture the potential OTC component.

What did the exchanges do?

Kraken and Crypto.com each told Cointelegraph they had restricted accounts or blocked funds associated with the suspected theft. Both exchanges said their platforms “remained secure.”

The report frames those measures as responses to affected accounts and funds, alongside statements that the broader platforms were secure. It did not describe an equivalent restriction by OKX.

The disclosures did not quantify the duration or value of every restricted balance. They also did not state how much of the suspected $133 million the restrictions covered, so the measures cannot yet be measured as a recovery.

What remains unverified?

Cointelegraph contacted Crédit Mutuel Arkéa for comment but had not received a response by publication. ZachXBT also did not disclose how the attackers gained access to the funds.

Those gaps leave the institution’s alleged victim status and the technical cause of the theft unverified. Bitquery’s tracing links exchange accounts to withdrawals; it does not independently confirm Crédit Mutuel Arkéa’s role.

What is the next checkpoint?

The immediate verification points are a response from Crédit Mutuel Arkéa, disclosure of the access method and further tracing of exchange and OTC withdrawals. Until then, the $133 million figure remains an unverified estimate rather than a confirmed bank loss.

The next relevant disclosure could come from Crédit Mutuel Arkéa, Kraken, Crypto.com or OKX. The immediate exchange-enforcement window remains open while restrictions persist and transaction tracing tests whether OTC activity pushes losses above $133 million.