On-chain investigator ZachXBT has named French bank Crédit Mutuel Arkéa as the suspected institution behind a theft now estimated at more than $133 million. The bank has not confirmed the identification and, as of November 4, had issued no official statement about the incident.
How the estimate grew
ZachXBT first flagged the suspected theft on November 2, 2026, describing the victim only as an unnamed financial institution in Europe with funds taken from its accounts on centralized exchanges. His initial estimate was more than $106 million.
After that first disclosure, ZachXBT traced additional withdrawals totaling more than $27 million, pushing the estimated total past $133 million by November 4. Most of the money left the exchanges as stablecoins, specifically USDC and USDT, from platforms including Kraken, Crypto.com, and OKX, between November 1 and 2.
On November 4, ZachXBT identified the suspected victim by name. Crédit Mutuel Arkéa is a French cooperative bank with approximately $235 billion in assets under management.
The laundering playbook
According to ZachXBT’s analysis, roughly $63 million was converted to ETH within about four hours. The attackers also used instant exchanges, which swap one crypto asset for another without the account setup that larger platforms typically require. Some funds were converted into Monero, a privacy-focused cryptocurrency designed to obscure who sent what to whom.
ZachXBT’s analysis found that more than $30 million was laundered because of the delay in public disclosure from the victim institution. He was critical of how long it took for the theft to become public.
Exchanges respond, the bank does not
Some platforms have moved. Kraken took steps to restrict accounts linked to the fund movements, and cooperation with law enforcement has been noted. Crédit Mutuel Arkéa, meanwhile, has stayed silent. As of November 4, neither the bank nor the exchanges involved had released detailed statements about the incident.
That silence leaves important questions open. It is not publicly known how the exchange accounts were accessed, who controlled them, or what the bank was using them for.
Why the delay matters more than the total
The withdrawals happened between November 1 and 2. ZachXBT’s first public flag came on November 2, and the victim was not named until November 4. The more than $30 million laundered during the delay, per ZachXBT’s analysis, is effectively the cost of that mismatch. Traditional finance operates on business hours, while blockchains run nonstop and never take a weekend off.
What this means
For stablecoin issuers and regulators, the heavy use of USDC and USDT in the initial withdrawals may draw closer attention. Stablecoins are often freezable at the issuer level, which makes early notification even more valuable. Once funds are swapped out of them, that option disappears.
There are several things to watch from here. The first is whether Crédit Mutuel Arkéa confirms or disputes the identification. The second is whether additional withdrawals surface, as they already did once, pushing the total higher. With a significant share of funds reportedly converted to ETH and Monero, the realistic window for recovery has narrowed considerably.
