Blockchain investigator ZachXBT has named French banking group Crédit Mutuel Arkéa as the suspected victim of a cryptocurrency theft worth more than $133 million, following his probe into a series of unusual withdrawals from centralized crypto exchanges. The episode illustrates how on-chain forensics can surface potential incidents before any affected institution has publicly acknowledged them.

Crédit Mutuel Arkéa has not publicly confirmed any connection to the transactions or acknowledged financial losses. As a result, the alleged breach, the amount involved, and the bank's ties to the activity remain unverified.

Timeline of the Investigation

On November 4, ZachXBT reportedly identified Crédit Mutuel Arkéa as the institution potentially affected by the suspicious transactions. The banking group holds approximately $235 billion in assets, which would make the suspected theft a notable event for the traditional financial sector.

The investigation began on November 2, when ZachXBT flagged more than $106 million in suspicious cryptocurrency withdrawals. The transactions reportedly originated from exchange accounts associated with an unidentified European Union entity, as CoinDesk reported. Withdrawals of this scale are the kind of activity on-chain investigators typically monitor, since unusually rapid flows between exchange accounts can signal unauthorized access or compromised accounts.

A day later, on November 3, the investigator uncovered an additional $27 million in withdrawals linked to the same suspected attacker, pushing the estimated value of the alleged theft above $133 million.

ZachXBT also suggested that a major Western European financial institution may have failed to disclose the incident. However, no independent evidence has established that the bank deliberately concealed a security breach.

Stolen Funds Moved Through Ethereum and Monero

Blockchain transaction analysis indicates that the suspected attacker initially withdrew funds in USDC and USDT stablecoins — the two most widely used dollar-pegged tokens, whose movements across public blockchains can be followed transaction by transaction. The assets were subsequently routed through Ethereum, instant cryptocurrency exchanges, and cross-chain bridges, a combination of routing steps that can fragment an audit trail across multiple networks and services.

Investigators also identified transactions involving Monero, a privacy-focused cryptocurrency that obscures transaction details. Such transfers can make it considerably harder for authorities to trace assets and recover stolen funds.

ZachXBT claimed that delayed disclosure allowed more than $30 million to move beyond potential recovery measures, and suggested that European law enforcement might have frozen some assets had they received earlier notification. He added that the transaction patterns appeared inconsistent with those typically associated with North Korea's Lazarus Group — the state-linked hacking collective that U.S. and allied authorities have blamed for some of the largest cryptocurrency thefts on record. The identity of the suspected attacker remains unknown.

Bank Confirmation Remains Critical

The allegations raise questions about cryptocurrency custody, institutional security practices, and incident reporting standards within Europe's financial industry — territory now shaped for EU banks by the Digital Operational Resilience Act, in application since January 2025, which requires financial entities to report major ICT-related incidents to regulators. Still, suspicious blockchain transactions alone cannot establish that a particular bank suffered a confirmed financial loss.

Authorities have not publicly verified the alleged theft or determined how the suspected attacker accessed the exchange accounts. Further confirmation from Crédit Mutuel Arkéa, the cryptocurrency exchanges involved, or regulators will be essential to establish the incident's actual scope. In the meantime, the most consequential signals to watch include any public response from the bank, disclosures from the exchanges whose accounts were used, potential law enforcement action against funds that remain traceable, and whether further withdrawals tied to the same suspected attacker are identified.