What to Know
- Blockchain investigator ZachXBT identified Crédit Mutuel Arkéa as the suspected victim of a cryptocurrency theft exceeding $133 million.
- ZachXBT initially put the losses at more than $106 million before later identifying another $27 million in withdrawals from centralized crypto exchanges.
- Crédit Mutuel Arkéa confirmed an attack involving fraudulent transactions and said the situation was now under control.
- The French banking group did not disclose the amount stolen or clarify whether the affected funds were held in traditional currency or cryptocurrency.
- Bitquery traced $108.8 million in USDC withdrawn from Kraken, Crypto.com and OKX accounts over 21 hours on November 1 and 2.
- Much of the traced money was converted into ether, an asset that cannot be frozen by a central issuer.
- Crypto.com said it blocked funds linked to the incident and that all user funds remained secure and accessible.
- ZachXBT said he had a high degree of confidence that North Korea's Lazarus Group was not behind the latest attack, citing differences in fund movement.
French Bank Drawn Into Major Crypto Theft Probe
French banking group Crédit Mutuel Arkéa has been pulled into one of the most closely watched crypto theft investigations of the week after blockchain investigator ZachXBT identified the institution as the suspected victim of a theft exceeding $133 million. The case centers on large withdrawals from accounts at centralized cryptocurrency exchanges and the rapid movement of funds across hundreds of wallets.
Crédit Mutuel Arkéa confirmed that an attack had taken place and said the incident had enabled fraudulent transactions. The bank added that the situation was now under control, though it did not disclose the total amount stolen. It also did not specify whether the affected funds were originally held in traditional currency or cryptocurrency, leaving a key question unanswered for market participants assessing the scale and mechanics of the breach.
The bank said the incident had no financial consequences for clients and that their interests were fully protected. It also said some transactions were temporarily suspended to prevent further losses and that relevant authorities had been notified. The group continues to assess the consequences of the attack, a process that may determine whether the final loss figure changes as investigators review exchange activity, internal controls and possible over-the-counter flows.
Loss Estimate Rose After Additional Exchange Withdrawals
ZachXBT first flagged the theft on Monday, initially estimating losses at more than $106 million. The figure later rose after another $27 million in withdrawals from centralized crypto exchanges was identified, lifting the suspected total to more than $133 million. The investigator also indicated that the final amount could be higher if over-the-counter trades are included.
That uncertainty is significant because crypto thefts involving centralized venues can unfold across several layers of activity. Funds may move from exchange accounts into personal wallets, then through additional addresses, swaps or liquidity routes. In some cases, over-the-counter activity can obscure the path of assets if transactions occur outside public order books. While blockchain transfers can be visible, tying those transfers to specific account holders, counterparties or operational failures often requires cooperation from exchanges, analytics firms and law enforcement.
The public loss estimate has therefore become a focal point, but it remains only part of the picture. The unanswered questions include how the attacker gained access to the relevant accounts, whether the activity involved compromised credentials, internal process weaknesses, social engineering or another method, and how much of the money may still be recoverable. Until those details are clarified, the case remains an active investigation rather than a fully resolved account of the breach.
Bitquery Tracks USDC Flows Across Major Exchanges
Blockchain analytics firm Bitquery traced $108.8 million in USDC withdrawn from accounts at Kraken, Crypto.com and OKX over 21 hours on November 1 and 2. The funds were then tracked through hundreds of wallets, with much of the money converted into ether. That conversion matters because USDC can be frozen by its central issuer under certain circumstances, while ether does not have a comparable central freezing mechanism.
The movement from USDC into ether is a common point of interest for investigators because it can change the recovery profile of stolen assets. Stablecoins may be easier to immobilize when issuers and exchanges act quickly, while decentralized assets can be harder to stop once they move beyond centralized choke points. Even so, exchanges and analytics teams can continue tracing funds on public blockchains, and deposit addresses at regulated platforms can become critical points for intervention.
Bitquery also identified a transfer of 396 ETH into a Kraken deposit address. However, it was not established whether Kraken froze the funds or who controlled the receiving account. Kraken and OKX did not immediately provide public comments on the matter, while Crypto.com confirmed that it had taken action related to funds linked to the incident.
Crypto.com Says It Blocked Linked Funds
Crypto.com said it was aware of the matter and had taken action to block funds linked to the incident from moving through its platform. The exchange also said all user funds remained secure and accessible. That assurance is important because the case involves exchange accounts, but the available information does not suggest a platform-wide compromise at Crypto.com.
For centralized exchanges, incidents of this nature can create a sharp distinction between an account-level breach and an exchange infrastructure breach. An account-level compromise may involve unauthorized access to specific customer or institutional accounts, while an exchange infrastructure breach would imply a broader failure affecting the platform itself. In this case, investigators have not determined how the attacker accessed the exchange accounts, and Crypto.com's statement focused on blocking linked funds and preserving user access.
Rapid exchange coordination can be decisive in large crypto thefts. When suspicious funds reach a major platform, compliance teams may be able to freeze deposits, block withdrawals or provide information to investigators under applicable legal processes. However, once funds are converted and dispersed across many wallets, recovery can become more difficult, particularly when assets move through networks or instruments that lack centralized control.
Bank Was Preparing Crypto Services Under EU Rules
The incident comes as Crédit Mutuel Arkéa has been preparing to enter the cryptocurrency business. In May, French financial newspaper L'Agefi reported that the bank had applied for a license under the European Union's MiCA rules to offer crypto services to retail customers and other financial institutions. That detail gives the case added relevance for the European digital asset sector, where traditional financial institutions are increasingly exploring regulated crypto services.
MiCA is designed to create a clearer regulatory framework for crypto asset service providers in the European Union. For banks, the framework may support a more formal path into custody, trading or related services, but it also raises expectations around operational resilience, client protection and risk management. A confirmed fraud incident at a bank preparing crypto services will likely sharpen attention on how traditional institutions secure accounts, manage exchange relationships and monitor unusual flows.
The bank said clients were protected and that some transactions were suspended as a precaution. Still, the episode underscores the complexity facing institutions that bridge traditional finance and digital assets. Crypto markets settle quickly, operate around the clock and allow rapid cross-border transfers. Those features can benefit legitimate users, but they also require specialized monitoring and response capabilities when suspicious activity occurs.
Investigators Do Not Attribute Case to Lazarus
The suspected breach follows several cryptocurrency thefts, including attacks on BTCPay Server and Brazil's Mercado Bitcoin, as well as the $6.3 billion Binance hack, which the FBI attributed to North Korean hackers. Against that backdrop, any major crypto theft immediately raises questions about whether state-linked groups may be involved.
In this case, ZachXBT said he had a high degree of confidence that North Korea's Lazarus Group did not carry out the latest attack. The assessment was based on differences in how the stolen funds were moved. That distinction matters because blockchain investigators often use behavioral patterns, wallet infrastructure, laundering routes and timing to compare new thefts with known threat actor activity.
Still, the lack of a Lazarus attribution does not resolve who was responsible. It only narrows one prominent possibility. Market participants will now watch for further exchange statements, law enforcement updates and onchain movements that may help clarify whether the stolen assets can be frozen, recovered or definitively tied to a particular actor.
Frequently Asked Questions (FAQs)
Who is the suspected victim of the crypto theft?
Blockchain investigator ZachXBT identified French banking group Crédit Mutuel Arkéa as the suspected victim of a cryptocurrency theft exceeding $133 million. The bank confirmed an attack involving fraudulent transactions but did not disclose the amount stolen.
How much money was allegedly stolen?
ZachXBT initially estimated losses at more than $106 million, then identified another $27 million in withdrawals from centralized crypto exchanges, raising the suspected total to more than $133 million. The amount could be higher if over-the-counter trades are included.
Which exchanges were mentioned in the fund movements?
Bitquery traced $108.8 million in USDC withdrawn from accounts at Kraken, Crypto.com and OKX over 21 hours on November 1 and 2. Crypto.com said it blocked funds linked to the incident, while Kraken and OKX did not immediately provide public comments.
Did Crédit Mutuel Arkéa confirm the exact loss amount?
No. Crédit Mutuel Arkéa confirmed that an attack had enabled fraudulent transactions and said the situation was under control, but it did not disclose the amount stolen or clarify whether the affected funds were traditional currency or cryptocurrency.
Were bank clients financially affected?
Crédit Mutuel Arkéa said the incident had no financial consequences for clients and that their interests were fully protected. The bank also said it temporarily suspended some transactions to prevent further losses.
Why does the conversion from USDC to ether matter?
USDC can be frozen by a central issuer in certain circumstances, while ether does not have the same central freezing mechanism. Converting funds into ether can make recovery more difficult, although blockchain tracing can continue.
Is Lazarus Group believed to be responsible?
ZachXBT said he had a high degree of confidence that North Korea's Lazarus Group was not responsible for the latest attack, citing differences in how the stolen funds were moved. That does not yet identify who carried out the theft.
Why is this incident important for European crypto regulation?
Crédit Mutuel Arkéa had been preparing to enter the cryptocurrency business and reportedly applied for a license under the EU's MiCA rules. The incident highlights the security and compliance demands facing traditional banks moving into digital assets.
