ZachXBT Names French Bank Crédit Mutuel Arkéa as Alleged Victim of $133M Crypto Theft

On-chain investigator ZachXBT has named the institution behind a crypto theft he now tallies at more than $133 million: Crédit Mutuel Arkéa, a French banking group holding roughly $235 billion in assets. The attribution arrived in a November 4 update to his Investigations channel, three days after he first flagged an unidentified European institution losing more than $106 million across centralized-exchange accounts.

“Disclosing the EU financial institution exploited for $133M+ is allegedly Credit Mutuel Arkea, a French bank with $235B in assets,” ZachXBT wrote. “The attack on the bank occurred for multiple days. I suspect the amount stolen is larger when accounting for OTC activity.”

The $133M Trail: Stablecoins, ETH, Then the Privacy Coin

The money moved the way laundering-aware thefts tend to move: out through stablecoins, into Ethereum, then into Monero (XMR), where balances stop being trivially traceable. The suspected attacker withdrew funds in USDC and USDT from multiple centralized-exchange accounts, swapped them into ETH, and then into the privacy coin XMR, moving the proceeds across several blockchains, according to ZachXBT’s tracing.

Routing through XMR is the standard endgame for this class of theft because Monero hides amounts and counterparties on-chain. Unlike USDT and USDC, which have issuers able to freeze a balance, a Monero holding has no central party to claw it back. That is why a thief laundering $133 million rotates out of the stablecoins quickly and toward the ETH-to-XMR hop, where the trail effectively ends.

ZachXBT published four addresses as the incident’s on-chain footprint:

• 0x5cf70edce65847ef989933c3072fb0e7f335abc1
• 0xe378cdccb369a64a0190577787ef61ca2eefa6b2
• 0x3e6c3d135ca8f8be793e5fe1715ce6c057d140f2
• 0x99d314e6970b8d3db0dbe6f6e041cc904143400f

From $106M to $133M — and the $30M That Could Have Been Frozen

The total climbed as the investigator kept digging. On November 1 he flagged a European entity losing more than $106 million from exchange accounts; by November 4 the figure stood above $133 million. “I’ve identified an additional $27M+ of CEX withdrawals by the illicit actor bringing the total to $133M+ for the incident,” he wrote in an earlier update.

His sharper claim is about timing. “No proper incident disclosure has resulted in $30M+ being laundered away which could have been frozen by EU law enforcement,” ZachXBT wrote, adding that “a large financial institution in Western Europe was exploited and it’s currently being covered up.” At $30 million-plus, that is roughly 23% of the $133 million total — money he says moved after his initial public disclosure and could have been frozen with a faster official response.

The flow matters beyond the bank itself. When a thief moves $133 million out of stablecoins, the conversion into ETH and XMR shows up as demand on those markets — modest against ETH’s daily volume, but a signal that stolen funds are rotating toward assets that cannot be clawed back. For exchanges watching the four addresses, the risk is less the sale than the reputational cost of handling proceeds from a bank theft.

A Bank, an Exchange, and a Docs Platform in the Same Week

The disclosure lands in a week already crowded with institutional security failures. Brazil’s Mercado Bitcoin halted withdrawals after a $40 million drain across ten chains, and BitMart’s founder confirmed a smaller breach he tentatively linked to the same actors. The $6.34 billion Binance hack — six months in the making and now partly reversed — still dominates the security conversation. At $133 million, the bank’s loss is small against Binance’s total, roughly 2%, but it points at a different target set: traditional financial institutions sitting on crypto rails.

Alleged, Not Confirmed: What the Record Still Doesn’t Show

Everything here rests on one investigator’s tracing. ZachXBT’s naming is an allegation — he wrote “allegedly” — and no regulator, bank statement, or law-enforcement filing has confirmed the victim or the loss. Crédit Mutuel Arkéa has not publicly acknowledged the incident as of publication. ZachXBT has also not identified the attacker; he has mapped the flow and drawn a conclusion about the victim, which leaves the four addresses as a starting point for recovery rather than proof of how much can be recovered.

What would settle it is a statement from the bank or a French or EU authority, a freeze or seizure of the remaining funds, or movement on the four published addresses. Until then, the $133 million figure, the laundering path, and the bank’s identity remain ZachXBT’s read of the on-chain record rather than an official account.