Mentioned in This Article
1. Crédit Mutuel Arkéa hack: what is alleged
On November 4, 2026, the on-chain investigator ZachXBT identified the French cooperative bank Crédit Mutuel Arkéa as the likely victim of a crypto theft that he now puts at more than $133 million. The funds left accounts held at centralized exchanges in the form of stablecoins. The bank has not confirmed the identification, and as of November 4 it had published no official statement.
ZachXBT is a pseudonymous researcher who follows stolen funds across public blockchains and often publishes his findings before the affected organizations speak. His attribution is therefore an allegation rather than an established fact, and it rests on his own tracing of wallets and withdrawals. Crédit Mutuel Arkéa is a French cooperative lender with roughly $235 billion in assets under management, which makes the reported sum large in absolute terms but small against the size of the institution.
2. How did the estimated loss grow past $133 million?
The figure rose in a matter of days. ZachXBT first drew attention to the case on November 2, when he described the victim only as an unnamed European financial institution whose funds had been taken from accounts on centralized exchanges. His opening estimate was above $106 million.
That number did not stand. After the first disclosure he traced further withdrawals worth more than $27 million, and the combined total passed $133 million by November 4. Revisions of this kind are common in on-chain investigations, because stolen funds are often split across many addresses and each new link in the chain can reveal additional movements that were not visible at the start.
The withdrawals took place between November 1 and November 2. Most of the money left the platforms as the dollar-pegged stablecoins USDC and USDT, and the exchanges named in the tracing were Kraken, Crypto.com and OKX.
3. How does on-chain tracing identify a victim?
Public blockchains record every transfer permanently, and anyone can read them. Investigators such as ZachXBT start from a known address or a cluster of suspicious withdrawals and follow the money forward, noting where it lands, how it is split and which services receive it. Labels for exchange deposit addresses, built up over years, let a researcher say that a given payment entered Kraken, Crypto.com or OKX even when the platforms themselves stay quiet.
Naming a victim is a different step from tracing the money, and it is the part that deserves the most caution. A wallet reveals movements, not ownership, so linking funds to a specific institution usually depends on patterns, timing and information from outside the chain. That is why the identification of the bank remains unconfirmed until the bank or the exchanges speak, even though the movements of the money themselves can be checked by anyone with a block explorer.
4. The laundering route: instant swaps, Ether and Monero
According to ZachXBT's analysis, the thieves moved quickly once the money was out. Roughly $63 million was converted into Ether (ETH) within about four hours of the withdrawals. Speed matters in cases like this, because every hour that funds remain in a recognizable form is an hour in which an issuer or an exchange could still act on them.
The attackers relied on instant exchanges, services that swap one crypto asset for another without the account setup that larger platforms usually demand. Such services let a holder change assets without opening a customer relationship, which weakens the identity checks that regulated venues apply.
Part of the proceeds was also exchanged into Monero (XMR), a cryptocurrency built to hide the sender, the recipient and the amount of a transaction. Once value moves into an asset of that kind, following it on a public ledger becomes far harder than it is with Ether or with stablecoins that circulate on transparent networks.
The sequence described here, stablecoins into Ether and then a share into Monero, follows a familiar sequence. Stablecoins are convenient for taking large sums out of exchanges, but they carry the risk of a freeze. Ether is liquid and accepted almost everywhere, yet it remains traceable. A privacy coin is the last step for those who want to break the trail. Each conversion removes one tool that investigators and issuers might otherwise have used.
5. Why the delay in disclosure matters
ZachXBT's analysis found that more than $30 million was laundered because of the delay in making the theft public, and he was openly critical of how long the incident took to surface. The timeline explains his concern. The withdrawals happened on November 1 and 2, he raised the first public alarm on November 2, and the victim was named only on November 4.
The reported cost of that gap, in the words of the underlying account, is effectively the price of a mismatch between two systems. Traditional finance runs on business hours, internal escalation procedures and sign-offs, while blockchains operate around the clock, including weekends. A theft that begins over a weekend can be largely completed before the first compliance officer returns to a desk.
That does not mean any particular person at the bank made a wrong decision. The facts of the bank's internal response are unknown, and the institution has said nothing. The point is structural: the speed of the laundering is set by the market, while the speed of disclosure is set by organizational process.
For financial institutions, the episode illustrates why crypto incident response plans differ from conventional fraud plans. A bank can usually reverse or recall a payment through established channels for a period of time. A blockchain transfer cannot be recalled, and the only levers are speed, public alerts and cooperation among platforms. A delay of two days, measured against a laundering operation that converted about $63 million in four hours, is a very long time.
6. How have the exchanges responded?
Some of the platforms involved have acted. Kraken restricted accounts linked to the movement of the stolen funds, and cooperation with law enforcement has been noted. Neither the bank nor the exchanges involved had released detailed statements as of November 4.
Freezing accounts on an exchange is one of the few tools available once stolen funds reach a regulated venue. It works only while the assets are still sitting in an account the platform controls. When thieves withdraw to their own wallets or pass the money through swap services, the exchange loses the ability to stop it, which is why the first hours after a theft carry so much weight.
The reported involvement of three large platforms also shows how thieves spread risk. Taking funds out through several venues in a short window makes each individual withdrawal look less unusual to the monitoring systems of any one exchange. It also means that the victim and investigators must contact several compliance teams, each with its own procedures, to have the flow of funds stopped, which adds to the time lost.
7. What remains unknown
Several basic questions are open. It is not publicly known how the exchange accounts were accessed, who controlled them, or what purpose the bank had for holding assets on those platforms. Without those answers it is impossible to say whether the incident was a compromise of credentials, an insider problem, a weakness at a service provider or something else.
The identification itself may also change. The bank could confirm or dispute it, and ZachXBT has already shown that his totals can rise as more withdrawals are traced. Anyone reading the figure of $133 million should treat it as a current estimate from one investigator, not as a verified loss.
8. Stablecoin freezes and the narrowing recovery window
The heavy use of USDC and USDT may draw closer attention from the companies that issue those tokens and from the regulators that oversee them. Stablecoins are often freezable at the issuer level, meaning the issuing company can block a token at a given address. That option disappears once the funds are swapped out of the stablecoin into another asset.
The two largest stablecoin issuers have a track record of freezing tokens when they receive a credible request from law enforcement or evidence of theft, so the first question after any large theft is how much remained in stablecoin form when the alert went out. In this case ZachXBT's account suggests that a large portion had already been converted, which reduces what an issuer could block. That is a general limit of the tool and not a comment on any particular company's response, as none has been reported here.
Because a significant share of the money was reportedly converted into Ether and Monero, the realistic window for recovery has narrowed considerably. Ether can still be followed on a public ledger, but a freeze is not available for it in the way it is for a centralized stablecoin, and Monero is designed to resist tracing altogether.
What to watch next is whether Crédit Mutuel Arkéa confirms or rejects ZachXBT's identification, and whether further withdrawals come to light, as they already did once when the estimate climbed from $106 million to more than $133 million. Any statement from the exchanges or from the stablecoin issuers about frozen balances would also show how much of the total might still be recoverable.
Until those answers arrive, the case stands as an allegation backed by on-chain evidence. The totals, the dates of the withdrawals and the routes taken by the money can be examined by anyone, while the identity of the victim, the cause of the breach and the extent of any recovery depend on statements that have not yet been made by the bank, the exchanges or the authorities involved in the investigation.