Investigator ZachXBT alleges $133M theft from French bank Crédit Mutuel Arkéa

Onchain investigator ZachXBT has named French cooperative bank Crédit Mutuel Arkéa as the alleged victim of a crypto theft he now estimates at more than $133 million, according to The Block. As of this writing the bank has not confirmed, denied, or commented on the claim, and no authority has independently verified it. Treat this as one investigator's attribution, not an established fact.

The account unfolded over several days on ZachXBT's Telegram channel. On Nov. 2 he reported that an unnamed EU entity had lost over $106 million from multiple centralized-exchange accounts the day before, with funds pulled out as the stablecoins USDC and USDT. On Nov. 3 he raised the figure to above $133 million after tracing a further $27 million in withdrawals — some occurring after his initial post — and said a large Western European financial institution appeared to have been exploited and the incident covered up. That evening he identified the institution as Crédit Mutuel Arkéa, a bank The Block describes as holding roughly 211.5 billion euros (about $237 billion) in assets and serving more than 5.6 million customers.

ZachXBT said the attacker has been "aggressively" moving the money: swapping USDC for ETH, routing funds through instant exchanges including WellWallet and Kyrrex, converting to the privacy coin Monero (XMR) via a service he called Wagyu, and bridging across multiple chains. He said he has "a high degree of confidence" the attacker is not tied to North Korea's Lazarus Group, and he faulted the institution for allegedly letting more than $30 million be laundered — arguing that prompt disclosure to EU law enforcement could have frozen the funds. He cautioned the true loss could be higher once possible over-the-counter activity is counted.

Key facts

• Alleged loss: more than $133 million, up from an initial $106 million on Nov. 2 (ZachXBT, via The Block).
• Alleged victim: Crédit Mutuel Arkéa, €211.5B ($237B) in assets, 5.6M+ customers (ZachXBT; asset figure per The Block).
• Funds withdrawn as USDC/USDT, then swapped to ETH and XMR and bridged across chains (ZachXBT).
• ZachXBT: "high degree of confidence" the attacker is not Lazarus Group.
• Bank statement: none. Not independently verified by the bank or authorities (The Block).

The real-world read

Everything here traces to a single source — ZachXBT's own onchain analysis — relayed by The Block, which says it contacted the bank and got no response. ZachXBT has a strong track record, but a track record is not confirmation: there is no filing, no police statement, and no bank acknowledgment. His sharpest claim — that the institution is "covering up" the breach and let $30M-plus launder by not alerting EU law enforcement — is an accusation, not a documented finding, and the bank hasn't had its say. The escalating total ($106M → $133M) reflects an active, still-unfolding trace, so the number may move again. Note the figures are his estimates, not audited.

This is reporting on an unverified claim, not financial advice.

Sources

• The Block (Carlos Harrison / editorial), Nov. 4, 2026 — reported ZachXBT's allegations, the escalating loss estimates, the bank's asset and customer figures, and the lack of any bank or official confirmation. Secondary reporting citing ZachXBT's Telegram posts as its primary source. Not sponsored.