Blockchain investigator ZachXBT has identified French banking group Crédit Mutuel Arkéa as the alleged victim of a cryptocurrency theft exceeding $133 million, expanding an investigation into suspicious withdrawals from multiple centralized exchange accounts.

The November 4 disclosure named the institution after earlier alerts referred only to an unnamed European target. Crédit Mutuel Arkéa, one of France's largest cooperative banking groups, was described by ZachXBT as holding approximately $235 billion in assets, and he said the suspected attack continued over several days, with potential additional losses involving over-the-counter transactions — privately negotiated trades conducted outside public exchanges.

The bank's involvement has not been independently confirmed. No public response addressing the allegation was identified at publication, and the disclosures do not establish whether the affected assets belonged to the institution, its customers, or another party.

Additional Withdrawals Push Estimated Losses Above $133 Million

ZachXBT's initial alert on November 2 identified more than $106 million in suspected losses from exchange accounts hit the previous day. The funds were withdrawn as USDC and USDT, the two largest dollar-pegged stablecoins, before being moved through multiple services and blockchains.

He subsequently identified another $27 million-plus in exchange withdrawals, bringing his estimate above $133 million. Some withdrawals occurred after his initial public warning, indicating that the suspected outflows continued after the incident had already attracted attention.

The investigator published 11 suspected theft addresses in the original alert and four additional addresses in the follow-up. He did not name the exchanges holding the affected accounts or explain how the attacker obtained access to them.

The suspected laundering involved swapping USDC for ether, transferring funds through instant exchanges, and converting assets into Monero (XMR), a privacy-focused cryptocurrency whose protocol obscures transaction details. ZachXBT named WellWallet and Kyrrex among the services receiving transfers and identified Wagyu as a route for conversions into XMR. Those observations describe the movement of funds; they do not establish that the services knowingly participated in the theft.

"I suspect the amount stolen is larger when accounting for OTC activity," ZachXBT wrote in the update naming Arkéa. He did not provide a separate estimate for those transactions.

ZachXBT Criticizes Disclosure as Attacker Remains Unidentified

ZachXBT also alleged that inadequate disclosure allowed more than $30 million to be laundered that European law enforcement could otherwise have frozen. He described a possible cover-up as his working theory, rather than an established finding. Neither deliberate concealment nor the amount that authorities could have intercepted has been independently verified. The $30 million figure concerns funds allegedly moved during the incident, not a separate loss to add to the $133 million estimate. Freezing stolen cryptocurrency generally requires the exchanges, stablecoin issuers, or services holding the assets to act before the funds move beyond their control.

The attacker remains unidentified. ZachXBT said he was highly confident that the Lazarus Group — a North Korea-linked hacking collective that U.S. authorities have blamed for some of the sector's largest cryptocurrency thefts — was not responsible, citing multiple laundering indicators. He did not publicly detail those indicators, and his assessment is not a formal law-enforcement attribution.

The disclosures follow Mercado Bitcoin's suspension of services after a security breach and the FBI's attribution of the Binance theft to North Korea's TraderTraitor operation, adding the alleged Arkéa theft to a recent stretch of security incidents across the digital-asset sector. ZachXBT's posts provide no evidence connecting the suspected Arkéa incident to either case.

The latest update does not establish how the exchange accounts were compromised, whether unauthorized access has been contained, or how much cryptocurrency has been frozen or recovered. Whether Crédit Mutuel Arkéa publicly addresses the allegation, whether further withdrawals or addresses are disclosed, and whether European authorities or the named services move to freeze funds tied to the incident are the key developments to watch.