According to blockchain investigator ZachXBT, the French cooperative bank Cr é dit Mutuel Ark éa has been identified as a suspected victim in a cryptocurrency theft case, with the amount involved exceeding 133 million US dollars. On November 3, 2026, he named this bank, stating that this conclusion was based on his tracking of withdrawals from multiple centralized exchange accounts. The accusation is based on his analysis, rather than confirmation from the bank or regulatory authorities.
Key Points
- ZachXBT has tracked an additional $27 million since the initial report.
- The suspected withdrawals are related to USDC and USDT.
- Funds are transferred via instant exchange services, Monero conversion, and blockchain bridges.
- Kraken restricted the relevant accounts and denied that their system had been compromised.
Cr is dit Mutuel Ark How did the amount stolen rise to 133 million US dollars?
After discovering additional withdrawals of $27 million from exchanges, ZachXBT raised the estimated amount from over $106 million to over $133 million. Some of these transactions occurred after he first disclosed the incident.
In his preliminary report released on November 2, he stated that an unidentified EU entity suffered losses the previous day through withdrawals. The relevant funds were transferred out from multiple centralized exchange accounts in the forms of USDC and USDT.
On the evening of November 3rd, he identified Cr é dit Mutuel Ark éa as suspected victims. The bank serves over 5.6 million customers and has total assets of 211.5 billion euros, which is approximately 237 billion US dollars.
Tracking exchanges, instant trading platforms, and blockchain bridges
ZachXBT indicates that this attack lasted for several days, and his estimates may not yet include the additional losses related to over-the-counter trading activities.
In a message published on Telegram on November 2nd, he stated that the attackers quickly exchanged USDC for ETH and transferred funds through instant exchange services that included WellWallet and Kyrrex. The related pathways also involved converting funds into Monero (XMR) via Wagyu, as well as using cross-chain bridges to transfer assets between different blockchains.
Therefore, ZachXBT's description of this suspected Cr é dit Mutuel Ark éa theft case not only covers the initial withdrawals from the exchange but also includes subsequent asset conversions and cross-chain transfers.
ZachXBT questions the disclosure of information and rules out any association with Lazarus
ZachXBT indicates that he is 'highly confident' that the attackers have nothing to do with North Korea Lazarus Group. However, this judgment still falls within the attributions of that investigator and is not a conclusion published by the competent authorities.
He also criticized the way the institution handled information disclosure, stating that the delay led to over $30 million being laundered. In his view, if the EU law enforcement authorities had been notified in a timely manner, these funds could have been frozen.
Exchange Restrictions and Bank Responses
Kraken restricted the accounts related to this incident and stated that neither its system nor customer accounts were compromised. Crypto.com also took action to freeze the relevant funds, while OKX began to investigate these allegations.
As of November 4th, Cr and dit as well as Mutuel Ark have not issued any public statements to confirm or deny this suspected theft incident. The estimation of losses, transaction tracking, and attribution are still based on the investigation by ZachXBT and have not yet been independently verified by the bank or the regulatory authorities.
This article was generated with the assistance of artificial intelligence and has been reviewed by an editorial team.
Author: Amelia Tomasicchio
