Crédit Mutuel Arkéa $133M Crypto Theft Allegation: ZachXBT's Timeline, the $30M Freeze Claim — and 5 Checks Before You Trust an Exchange

A French banking group with about $235 billion in assets allegedly lost more than $133 million in cryptocurrency in a multi-day theft — and, according to the investigator who traced it, more than $30 million of that money might still have been freezable if the alarm had been raised sooner. The bank, Crédit Mutuel Arkéa, has not confirmed anything. That single sentence captures both why this story matters and why it must be handled with care: the numbers are large, the victim is a household-name bank, and almost everything the public knows so far comes from one pseudonymous on-chain investigator, ZachXBT.

This article separates what is documented from what is merely alleged, reconstructs the timeline of the theft as reported, explains how the funds were allegedly laundered, and ends with five practical checks any crypto holder should run on their own exchange accounts today. Nothing here is investment advice, and nothing in this article should be read as proof that the bank was hacked — because, as of November 4, 2026, that proof has not been published.

What ZachXBT Actually Claims

ZachXBT is a pseudonymous blockchain investigator known for tracing stolen crypto funds and publicly identifying wallets linked to hacks and scams. His reporting on this case unfolded in three stages, and the figures grew at each step — a pattern readers should note, because it is typical of fast-moving on-chain investigations where new wallets keep surfacing.

On November 2, 2026, ZachXBT reported that an unnamed European entity had lost more than $106 million from multiple centralized exchange accounts the previous day, November 1. The funds were withdrawn as USDC and USDT, the two largest dollar-pegged stablecoins. He published 11 suspected theft addresses in that first alert.

On November 3, he raised the estimated total above $133 million after tracing an additional $27 million in withdrawals, some of which occurred after his initial disclosure — meaning the theft, or at least the movement of funds, was still ongoing while he was reporting it. He added four more suspected addresses, bringing the published total to 15.

On the evening of November 3, he named the alleged victim: Crédit Mutuel Arkéa, a French cooperative banking group he described as holding approximately $235 billion in assets. He said the attack spanned multiple days and warned that the real total could be higher once over-the-counter (OTC) activity is counted, because OTC deals do not leave the same clean on-chain trail as exchange withdrawals.

Two further claims from ZachXBT deserve attention. First, he said he has a high degree of confidence that the attacker is not associated with North Korea's Lazarus Group, the state-linked hacking collective blamed for the $6.3 billion Binance theft days earlier — a notable distinction, because it suggests this was a different kind of operation. Second, he alleged that inadequate disclosure allowed more than $30 million to be laundered that European law enforcement could otherwise have frozen. That second claim — that delay cost money — has not been independently verified, and neither deliberate concealment nor the amount authorities could have intercepted has been confirmed by any official source.

The Timeline: From $106 Million to $133 Million and Counting

Date	What was reported	Amount
November 1, 2026	Suspicious withdrawals from multiple centralized exchange accounts belonging to an unnamed EU entity	Over $106 million in USDC and USDT
November 2, 2026	ZachXBT publishes his first alert, with 11 suspected theft addresses	$106 million-plus
November 3, 2026	Four more addresses traced; additional withdrawals identified, some after the first alert	Above $133 million
Evening, November 3, 2026	ZachXBT names Crédit Mutuel Arkéa as the alleged victim	$133 million-plus, possibly higher with OTC activity
November 4, 2026	Exchanges and stablecoin issuers respond with freezes and blocks; bank still silent	$1.1 million USDT and $3.74 million USDC frozen

The timeline matters for a simple reason: in crypto thefts, speed is everything. Stablecoins can be frozen by their issuers, exchange accounts can be restricted, and bridges can be monitored — but only if someone acts before the funds are swapped into assets that cannot be frozen. That window, in this case, appears to have closed within hours for most of the money.

Verified vs Alleged: What We Know and What We Do Not

This is the section most coverage skips, and it is the most important one. A $133 million bank theft is a serious claim, and readers deserve to know exactly which parts rest on evidence and which rest on one investigator's analysis.

Claim	Status
More than $106 million was withdrawn from exchange accounts on November 1	Reported by ZachXBT from on-chain tracing; consistent with exchange responses described below
The total exceeds $133 million after further withdrawals	ZachXBT's estimate; additional addresses published, but no official confirmation
The alleged victim is Crédit Mutuel Arkéa	ALLEGED — named by ZachXBT only; the bank has issued no statement confirming or denying it
The attacker is not Lazarus Group	ZachXBT's assessment with high confidence, based on laundering indicators; not independently verified
More than $30 million could have been frozen with faster disclosure	ALLEGED — ZachXBT's opinion; the amount and any concealment are unverified
How the accounts were compromised	UNKNOWN — no mechanism (phishing, insider access, custody failure, hot-wallet breach) has been disclosed
Whether the funds belonged to the bank, its customers, or another party	UNKNOWN — reporting does not establish ownership of the affected assets
Tether froze $1.1 million in USDT; Circle froze $3.74 million in USDC	Reported via Cointelegraph's coverage of the case
Kraken restricted linked accounts; Crypto.com moved to block funds; OKX is investigating	Reported exchange responses; Kraken said its own systems and customer accounts were not compromised

The honest summary: something large and suspicious clearly happened on-chain, and exchanges reacted as if it did — but the victim's identity, the method, and the final total remain unconfirmed.

How the Money Allegedly Moved

According to ZachXBT's tracing, the laundering followed a playbook that will be familiar to anyone who has followed major crypto thefts — and that familiarity is itself a warning, because it shows how quickly stolen stablecoins can be converted into assets that are far harder to recover.

First, the stolen USDC and USDT were swapped for ether. Reporting citing Cointelegraph puts about $63 million of stablecoins swapped for roughly 27,553 ETH within about four hours — a pace that suggests automation, not manual trading. Ether is the natural first hop: it is liquid everywhere, it moves across chains easily, and it is the entry point to decentralized finance.

Second, the funds were routed through instant exchanges — services that swap one asset for another without an account — with WellWallet and Kyrrex named among the services receiving transfers. Instant exchanges are a known laundering chokepoint because they sit between the transparent world of centralized exchanges and the opaque world of privacy tools.

Third, funds were converted into Monero (XMR) via Wagyu, a route ZachXBT identified for XMR conversions, and bridged across multiple chains. Monero is designed to hide sender, receiver, and amount, which is why it is the final destination in so many laundering chains — and why privacy coins remain one of the most contested topics in crypto regulation. Once funds enter Monero, on-chain tracing effectively ends.

Fourth, ZachXBT flagged possible OTC activity that could push the total higher. OTC deals — private, off-exchange trades — would not appear in the exchange-withdrawal data he traced, so the $133 million figure may be a floor rather than a ceiling.

The recovery math is sobering. Against a loss above $133 million, the confirmed freezes so far amount to $1.1 million in USDT by Tether and $3.74 million in USDC by Circle — under $5 million combined, or less than 4 percent of the alleged total. That gap is not a criticism of the issuers; it is a measure of how fast the laundering chain moved. Freezes only work on stablecoins that are still stablecoins. Once they become ether, and then Monero, there is nothing left to freeze.

Why a Bank Holding Crypto on Exchanges Matters

If the Arkéa identification is correct, the case raises a question that goes far beyond one theft: why would a bank with $235 billion in assets hold nine figures of crypto in centralized exchange accounts at all?

The short answer is that banks are moving into crypto custody at speed, and the plumbing is still being built. In the United States, Citi, BNY, and Deutsche Bank are competing in a custody race measured in tens of trillions of dollars of assets, and regulators have spent 2026 clearing paths for tokenized securities and compliant trading venues. In Europe, France's Markets in Crypto-Assets (MiCA) framework now governs crypto custody and services across the EU. Banks that want to serve crypto clients — or hold crypto themselves — must choose between building their own custody, using a specialist custodian, or holding assets on exchanges. Each option carries different risks, and exchange accounts are widely considered the weakest of the three for large balances, because they concentrate risk in a third party's hot wallets and account controls.

That context also explains why the silence from Arkéa matters. A bank that confirms a crypto theft must explain to regulators, auditors, and customers how the assets were held, who had access, and what controls failed. A bank that says nothing leaves the market to fill the gap with speculation. Neither posture is comfortable, and the longer the silence lasts, the more the speculation hardens into accepted narrative — which is exactly what happened in the first 48 hours of this case, as the $133 million figure spread across crypto media before any official confirmation existed.

For ordinary holders, the lesson is not about banks at all. It is about concentration: if a $235 billion institution can allegedly lose $133 million through exchange accounts, then no holder should treat an exchange balance as a vault. Exchanges are for trading. Storage belongs somewhere you control, as our guide to storing crypto safely with cold storage and seed phrases explains in detail.

What the Exchanges and Issuers Did

The response from the crypto industry, as reported, was fast but partial — and the partial nature of it is the point. Blockchain analytics firm Bitquery previously traced withdrawals from accounts at Kraken, Crypto.com, and OKX. Kraken restricted linked accounts and said its systems and customer accounts were not compromised — a carefully worded statement that suggests the affected accounts were not Kraken's own wallets but customer or institutional accounts on its platform. Crypto.com moved to block associated funds, and OKX said it was investigating.

On the stablecoin side, Tether froze $1.1 million in USDT and Circle froze $3.74 million in USDC. Those freezes demonstrate that the centralized control built into the two largest stablecoins does work — but only for funds that have not yet moved. The $63 million swapped for ether in roughly four hours shows how narrow that window is.

None of this confirms the victim's identity. What it confirms is that multiple major platforms treated ZachXBT's alerts as credible enough to act on, which is a meaningful signal in itself — exchanges do not restrict accounts lightly. But credibility of the alerts is not the same as confirmation of the bank's involvement, and readers should keep that distinction in mind.

5 Checks Before You Trust an Exchange With Your Coins

Whether you hold $100 or $100,000 in crypto, the Arkéa case is a prompt to audit your own setup. Run these five checks today, not after the next hack headline.

1. Is your balance on an exchange, or under your control? Anything you do not need for an imminent trade should be in a wallet you control — ideally a hardware wallet — with a seed phrase stored offline. Our cold-storage guide walks through the setup step by step. If your entire stack sits on one exchange, you are carrying the same concentration risk that allegedly cost a bank $133 million.

2. Are your exchange accounts locked down? Enable hardware security keys or authenticator-app two-factor authentication — never SMS alone — use a unique email address for crypto accounts, and set withdrawal allowlists so funds can only go to addresses you have pre-approved, with a time delay on any change. Check whether your exchange supports withdrawal address whitelisting and turn it on.

3. Do you know what your exchange would freeze, and what it could not? Stablecoins like USDT and USDC can be frozen by their issuers; bitcoin, ether, and Monero cannot. If you hold stablecoins for safety, understand that their safety depends on the issuer's blacklist working faster than a thief's swap — a race the thief won in this case within about four hours.

4. Are you diversified across venues? Splitting holdings across two exchanges and one self-custody wallet limits the damage from any single failure. The recent BitMart hack and the $6.3 billion Binance theft both showed that even large, established platforms can be hit — and our ranking of custody options after the Binance hack compares the alternatives side by side.

5. Would you notice a theft in time to act? Turn on withdrawal notifications by email and push alert, review your account's login and withdrawal history weekly, and know your exchange's emergency freeze process before you need it. In the Arkéa case, some withdrawals allegedly occurred after the first public alert — a reminder that detection delayed is recovery denied. Our honest guide to whether crypto is safe in 2026 covers the full risk checklist, from phishing to fake support scams.

What Happens Next

Five developments will decide how this story ends. First, whether Crédit Mutuel Arkéa issues a statement — confirmation, denial, or a neither-confirm-nor-deny notice to regulators. A denial would force a major reassessment of ZachXBT's tracing; a confirmation would trigger regulatory scrutiny in France and across the EU. Second, whether French regulators or law enforcement open a formal investigation, which would bring subpoena power and exchange cooperation that no independent investigator has. Third, whether any additional funds are frozen — every million recovered narrows the gap, but the Monero conversions suggest most of the money is already beyond reach. Fourth, whether the method of compromise is ever disclosed, because that is the detail that actually helps other institutions defend themselves. And fifth, whether the case changes how banks hold crypto — pushing more of them toward qualified custodians and away from exchange accounts, as the $94 trillion bank custody race already suggests.

Meanwhile, the broader market has barely blinked. Bitcoin traded around $77,000 on November 4, with Ethereum near $2,276, as traders focused on the US midterm results and Friday's jobs report. The market treats this as a security story, not a systemic one — unlike the $6.3 billion Binance hack, which moved prices for days.

Frequently Asked Questions

Did Crédit Mutuel Arkéa really lose $133 million in crypto?

Allegedly. On-chain investigator ZachXBT named the bank as the victim of a theft exceeding $133 million, but the bank has not confirmed or denied the claim as of November 4, 2026, and no regulator or law-enforcement agency has confirmed it either. Treat the identification as an allegation, not an established fact.

How did the theft allegedly happen?

The method has not been disclosed. ZachXBT traced withdrawals of USDC and USDT from multiple centralized exchange accounts on November 1, followed by swaps into ether, routing through instant exchanges, and conversions into Monero. Whether the accounts were compromised by phishing, insider access, a custody failure, or another method is unknown.

How much money has been recovered?

Very little so far relative to the alleged total. Tether froze $1.1 million in USDT and Circle froze $3.74 million in USDC, and exchanges restricted or blocked linked accounts. That is under $5 million against an alleged loss above $133 million, and funds converted to Monero are effectively untraceable.

Was North Korea's Lazarus Group responsible?

ZachXBT said he has a high degree of confidence that Lazarus Group was not responsible, citing laundering indicators that differ from the group's usual patterns. That assessment has not been independently verified, and the attacker remains unidentified.

Does this affect ordinary crypto holders?

Directly, no — there is no evidence that retail exchange accounts were affected. Indirectly, yes: the case is a reminder that exchange balances are not vaults, that stablecoin freezes only work before funds are swapped, and that self-custody remains the strongest protection for holdings you are not actively trading.

What should I do if I hold crypto on an exchange?

Move long-term holdings to a wallet you control, enable authenticator or hardware-key two-factor authentication, set withdrawal allowlists, turn on withdrawal alerts, and keep only trading funds on exchanges. The five checks in this article are a good starting point.

Conclusion

The Arkéa case, as it stands, is two stories at once. One is a breaking security incident: more than $133 million allegedly stolen from exchange accounts, laundered through ether and Monero in hours, with under $5 million frozen. The other is a story about evidence: a single investigator's tracing, amplified across crypto media, against a bank that has said nothing and a method that remains unknown. Both stories matter, and confusing them — treating allegation as fact, or dismissing a credible alert because it is unconfirmed — would be a mistake.

What is certain is the lesson for every holder, large or small: exchange accounts are convenient, not safe, and the window to freeze stolen funds is measured in hours, not days. Audit your accounts today, move what you do not trade into self-custody, and keep watching for the bank's response — because the next chapter of this story will be written by Arkéa itself, not by its tracers.

Sources: The Block, Cointelegraph, Crypto Briefing, CoinLab. All figures attributed to ZachXBT are his estimates and remain unconfirmed by the alleged victim. This article is for information only, not investment advice.