Crédit Mutuel Arkéa Faces Alleged $133M Theft as ZachXBT Traces $108.8M in USDC

French banking group Crédit Mutuel Arkéa has been linked to an alleged financial security breach involving more than $133 million, following an investigation by blockchain investigator ZachXBT. Blockchain analytics firm Bitquery traced approximately $108.8 million in USDC withdrawals from accounts associated with Kraken, Crypto.com and OKX over 21 hours between November 1 and 2.

The incident has attracted attention because the alleged victim is a major traditional financial institution rather than a cryptocurrency exchange or decentralized finance project. However, the exact nature and total value of the losses remain subject to investigation. Reports indicate that the original funds may have been stolen in fiat currency before being transferred into cryptocurrency.

CoinDesk reported on November 4 that Crédit Mutuel Arkéa acknowledged fraudulent transactions and said the situation was under control. The bank reportedly stated that customers would not suffer financial consequences, adding that some transactions had been temporarily suspended and relevant authorities notified. It did not publicly confirm the $133 million estimate.

ZachXBT initially reported more than $106 million in suspicious withdrawals from centralized exchange accounts before identifying an additional $27 million. This brought his estimated total above $133 million. He has also suggested that the actual losses could be higher if over-the-counter transactions are included.

How $108.8 Million in USDC Was Traced

Bitquery’s blockchain analysis identified approximately $108.8 million in USDC withdrawn from accounts at three major cryptocurrency exchanges. The transactions were spread across hundreds of wallets, making it possible to follow the movement of funds through multiple addresses and conversion services.

A significant portion of the stablecoins was subsequently exchanged for Ethereum. Bitquery traced approximately $62.98 million in stablecoins being converted into 27,553 ETH within roughly four hours. This is an important development because USDC can be frozen by its issuer under certain circumstances, whereas native ETH cannot be frozen through the same centralized mechanism.

The conversion therefore complicated efforts to restrict the movement of the assets. ZachXBT also described transfers through instant exchange services, conversions into Monero (XMR), and movements across multiple blockchain networks. These techniques can make tracing and recovering stolen funds more difficult, particularly when assets pass through several intermediaries.

The exchange withdrawals do not, by themselves, demonstrate that Kraken, Crypto.com or OKX suffered security breaches. The available reporting concerns funds leaving accounts held on those platforms. Crypto.com confirmed that it had blocked funds linked to the incident, while Kraken also reportedly restricted associated accounts. The exchanges have not been identified as the source of the original compromise.

Questions Over Disclosure and Institutional Security

The timing of the investigation has raised questions about how quickly the incident was reported to authorities and whether earlier intervention could have prevented additional transfers. ZachXBT criticized the alleged delay, arguing that more than $30 million may have been moved beyond the reach of potential freezes. That remains his assessment rather than an established finding from investigators.

ZachXBT has also expressed a high degree of confidence that the attacker was not associated with North Korea’s Lazarus Group, citing differences in the movement of funds. No definitive attribution has been publicly established, and the method used to gain access to the affected accounts remains unclear.

The incident highlights the growing intersection between traditional banking and cryptocurrency infrastructure. Financial institutions increasingly interact with digital asset exchanges, stablecoins and blockchain settlement networks, creating additional security considerations around account access, transaction monitoring and incident reporting.

For the wider crypto industry, the case demonstrates both the usefulness and limitations of blockchain analytics. Investigators can follow public transactions and identify suspicious movements, while stablecoin issuers and exchanges may be able to restrict assets held within their systems. Once funds are converted into assets such as ETH or Monero and distributed across different networks, recovery becomes more complicated.

The final losses, the precise origin of the stolen funds and the identity of those responsible remain unresolved. Until Crédit Mutuel Arkéa or relevant authorities provide further confirmation, the $133 million figure and the full attribution should be treated as reported allegations rather than a finalized account of the incident.