Crédit Mutuel Arkéa may have lost over $133 million in cryptocurrency
French banking group Crédit Mutuel Arkéa may have fallen victim to a major cryptocurrency theft involving more than $133 million. This conclusion was reached by blockchain investigator ZachXBT, who believes the financial institution's actual losses could be significantly higher.
According to a report by ZachXBT, the attackers withdrew funds over several days. The initial damage estimate did not include potential over-the-counter (OTC) transactions, which could have increased the total amount stolen.
The investigator first reported suspicious transactions on November 2. At the time, he identified withdrawals exceeding $106 million from the accounts of an unnamed European organization on centralized cryptocurrency exchanges. The funds were transferred in USDC and USDT stablecoins.
The following day, ZachXBT identified an additional $27 million in withdrawals, bringing the estimated losses to $133 million. Notably, some of these transfers occurred after his initial public warning.
How the attackers moved the stolen cryptocurrency
Blockchain analytics firm Bitquery traced suspicious transactions from accounts on Kraken, Crypto.com, and OKX. According to its findings, the attackers converted approximately $63 million in stablecoins into Ether (ETH) within just four hours.
The stolen assets were also transferred through instant exchange services WellWallet and Kyrrex, while some funds were converted into the privacy-focused cryptocurrency Monero (XMR) through Wagyu. Cross-chain bridges were used to move funds between different blockchains.
According to ZachXBT, more than $30 million had already been laundered. The investigator criticized the alleged victim for failing to promptly notify European Union law enforcement authorities. In his view, timely disclosure of the incident could have helped freeze some of the stolen funds.
ZachXBT also stated that he was highly confident that the North Korean hacking group Lazarus was not involved in the attack.
Representatives of Kraken and Crypto.com said they had restricted accounts or blocked suspicious funds linked to the incident. Both exchanges emphasized that their own security systems had not been compromised.
Crédit Mutuel Arkéa is a major French cooperative banking group serving more than 5.6 million customers. Its total assets amount to approximately €211.5 billion ($237 billion).
Major cryptocurrency thefts continue
The suspected cryptocurrency theft involving Crédit Mutuel Arkéa is the latest in a series of major attacks targeting financial institutions and cryptocurrency platforms. The most significant incident in recent days was the October 29 hack of Binance, during which attackers stole approximately $6.3 billion in digital assets. The attack became the largest theft in cryptocurrency industry history, far exceeding the losses recorded in previous incidents.
For comparison, hackers stole approximately $1.5 billion from cryptocurrency exchange Bybit in February 2025, while Japanese platform DMM Bitcoin lost more than $300 million worth of Bitcoin in May 2024. The series of major thefts has once again raised concerns about the security of digital asset custody, particularly on centralized platforms where attackers may gain access to substantial amounts of funds.
As a reminder, Binance has revealed how its platform was hacked.