ZachXBT Tracked a $133M Crypto Theft for Two Days. Then He Named the Victim

On-chain investigator ZachXBT has identified French cooperative bank Crédit Mutuel Arkéa as the alleged victim of a crypto theft worth over $133 million. The bank had not issued a public statement at the time of writing, and ZachXBT suspects the final figure could be larger once over-the-counter trades are counted.

Investigation Timeline

ZachXBT first flagged the incident on November 2, reporting that an unnamed EU entity had lost over $106 million from several centralized exchange accounts. The funds left those accounts as USDC and Tether. A day later, he reported another $27 million in exchange withdrawals, some occurring after his initial warning.

In his latest update, ZachXBT identified the institution as Arkéa, describing it as holding $235 billion in assets and stating the alleged attack spanned multiple days. Arkéa groups the Crédit Mutuel de Bretagne and Crédit Mutuel du Sud-Ouest federations, with approximately 40 subsidiaries including the online bank Fortuneo.

Security Concerns

Before naming Arkéa, ZachXBT theorized that a large Western European financial institution had been exploited, suspecting the incident was being covered up. He noted: "No proper incident disclosure has resulted in $30M+ being laundered away which could have been frozen by EU law enforcement."

Blockchain analytics firm Bitquery separately traced $108.8 million in USDC tied to the suspected theft, with withdrawals leaving Kraken, Crypto.com and OKX accounts over about 21 hours on November 1 and 2. They also found that $62.98 million in stablecoins converted to 27,553 Ethereum within roughly four hours.

Industry Context

Stablecoin freezes have prevented larger losses this year. After the Binance hack, issuers including Tether and Circle froze about $2.9 billion, covering roughly 45% of the stolen funds. The Binance attack pushed 2026 crypto security losses to a record above $8 billion.

"Unfortunate as it is, the Binance hack will, in our view, result in stronger security practices for exchanges going forward. It also underscores the importance of institutional custody, such as offered by US-based crypto ETPs," wrote Zach Pandl, Grayscale Head of Research.

BeInCrypto has contacted Crédit Mutuel Arkéa for comment and will update the story with any response. A confirmation would add a regulated European bank to 2026's crypto theft victims.