Blockchain investigator ZachXBT has identified the French cooperative banking group Crédit Mutuel Arkéa as the alleged victim of a substantial cryptocurrency theft, estimating losses above $133 million.
The bank, which manages assets in the region of $235 billion, has issued no public confirmation or denial of the claims as of early November 2026.
The sequence of alerts began on November 2, when ZachXBT reported that an unidentified European Union entity had seen more than $106 million withdrawn the previous day from multiple accounts on centralized exchanges.
The assets left primarily in the form of the dollar-pegged stablecoins USDC and USDT.
On November 3 he raised the running total past $133 million after tracing an additional $27 million or more in outflows, noting that some of those withdrawals continued even after his first public disclosure.
Later that evening he named Crédit Mutuel Arkéa and stated that the exploitation had stretched across several days.
ZachXBT has indicated that the published figure may understate the true damage.
He has specifically pointed to possible over-the-counter activity that would not appear in ordinary exchange order books or fully visible on-chain records.
In his assessment, the absence of timely public disclosure by the institution allowed more than $30 million to be moved through laundering pathways that European law-enforcement bodies might otherwise have been able to freeze.Movement of the funds followed a rapid and multi-stage pattern.
Blockchain analytics firm Bitquery traced substantial volumes leaving accounts associated with platforms including Kraken, Crypto.com, and OKX.
Roughly $63 million in stablecoins was converted into approximately 27,553 Ether within a few hours via on-chain routes such as UniswapX.
Subsequent transfers went through instant-exchange services, portions were swapped into the privacy-oriented cryptocurrency Monero, and assets were bridged across several networks. ZachXBT has expressed high confidence that the patterns do not match those typically associated with North Korea’s Lazarus Group.
Kraken and Crypto.com later stated that they had restricted or blocked accounts connected to the suspected activity while confirming that their own systems had not been breached.
The precise method of initial access remains undisclosed, and the bank’s alleged involvement has not been independently verified by other parties.
Media outlets that contacted Crédit Mutuel Arkéa for comment received no response by the time reports were published.
The episode highlights the intersection of traditional banking infrastructure and cryptocurrency markets, particularly as the named institution had previously explored regulatory approval to offer crypto-related services.
Independent trackers continue to monitor remaining identifiable balances and further movements, while the lack of an official statement from the bank leaves the full scope and implications of the incident unresolved.
The incident involving the alleged targeting of Crédit Mutuel Arkéa fits into a broader pattern of escalating cyber thefts that has marked 2026.
Throughout the year, on-chain and traditional financial platforms have faced a steady rise in sophisticated attacks, with cumulative losses climbing into the billions of dollars across dozens of incidents.
Attackers have refined techniques for exploiting centralized exchange accounts, bridge protocols, and institutional custody setups, often converting stolen assets into privacy coins or routing them across chains within hours.
What began as largely crypto-native breaches has increasingly spilled into regulated banking entities and hybrid services, as institutions expand their digital asset offerings.
The speed of these operations—frequently completing the bulk of fund extraction and initial laundering before public alerts circulate—has made containment more difficult and has raised questions about the adequacy of existing monitoring and response frameworks.
Such recurring large-scale thefts now present measurable risks to broader financial stability.
When a major cooperative bank with hundreds of billions in assets is implicated in a nine-figure loss, even if the funds originated from exchange accounts rather than customer deposits, the episode can erode confidence in the integration of cryptocurrency infrastructure with traditional banking.
Delayed disclosures allow significant portions of stolen value to exit recoverable channels, amplifying potential contagion if similar vulnerabilities exist at other institutions holding crypto for clients or proprietary purposes.
Regulators and supervisors face growing pressure to enforce stricter real-time incident reporting, cross-border freeze mechanisms, and capital buffers against operational losses in digital assets.
Without improved coordination between exchanges, stablecoin issuers, banks, and law enforcement, repeated events of this magnitude could undermine trust in both crypto markets and the wider financial system, particularly as more traditional players seek regulatory authorization to offer related services.
