Nov 4, 2026, 5:18 a.m. EST
2 min read
Summary
- Blockchain investigator ZachXBT identified Crédit Mutuel Arkéa as the suspected victim of a cryptocurrency theft exceeding $133 million, but the French banking group has not confirmed the report.
- Blockchain analytics firm Bitquery traced $108.8 million withdrawn from Kraken, Crypto.com and OKX accounts, but could not verify the full reported loss or identify the victim.
- Crypto.com said it blocked funds linked to the incident and that customer funds remained secure, while investigators have not determined how the attacker accessed the exchange accounts.
Renowned on-chain analyst ZachXBT pointed to French financial institution Crédit Mutuel Arkéa as the likely target of a digital asset theft surpassing $133 million via a broadcast sent on his Telegram channel earlier on Wednesday.
ZachXBT initially brought attention to the breach on Monday, estimating the damage at over $106 million. He later uncovered an additional $27 million pulled from centralized cryptocurrency trading platforms, bringing the cumulative total above $133 million, while noting that the total figure could climb higher once over-the-counter (OTC) transactions are factored in.
Crédit Mutuel Arkéa verified the security incident to CoinDesk on Wednesday, stating that unauthorized transactions had taken place but the situation was now contained. The lender, managing assets exceeding $250 billion, refrained from revealing the exact sum taken or whether the pilfered assets originated in fiat currency or digital tokens.
“This incident has no financial consequences for [our clients]. Their interests are fully protected,” a representative declared. The institution noted it had temporarily halted certain transactions to curb further exposure and alerted the proper authorities. Evaluation of the breach’s overall impact is ongoing.
The financial institution has been getting ready to venture into the digital asset sector. Back in May, French financial publication L’Agefi reported that the company applied for a permit under European Union MiCA regulations to supply crypto offerings to retail clients and alternative financial entities.
Data from blockchain analytics provider Bitquery shows that $108.8 million worth of USDC was removed from accounts at Kraken, Crypto.com, and OKX across a 21-hour window on November 1 and November 2.
The organization followed the capital across numerous wallets, observing that a significant portion was swapped into ether, a token that a primary issuer cannot freeze.
Bitquery also spotted a deposit of 396 ETH moving to a Kraken deposit destination, though it did not confirm whether Kraken froze those assets or who managed the destination wallet.
Kraken and OKX did not immediately reply to inquiries from CoinDesk.
Meanwhile, Crypto.com acknowledged that it stepped in. “We are aware of this report and have taken action to block funds linked to the incident from moving through Crypto.com. All user funds remain secure and accessible,” a representative stated.
This suspected compromise arrives on the heels of multiple digital asset breaches, featuring assaults on BTCPay Server and Mercado Bitcoin in Brazil, along with the massive $6.3 billion Binance exploit, which the FBI blamed on North Korean actors.
Consequently, regarding the French institution’s situation, ZachXBT mentioned he possessed a “high degree of confidence” that North Korea’s Lazarus Group was not behind this specific exploit, pointing to distinct patterns in how the stolen tokens were transferred.
Originally published at https://www.coindesk.com/business/2026/11/04/zachxbt-names-french-bank-credit-mutuel-arkea-as-suspected-victim-of-usd133-million-crypto-theft.
