# Suspected Crédit Mutuel Arkéa crypto theft (French bank, Nov 2023): ZachXBT alleges French bank Crédit Mutuel Arkéa lost over $133M in crypto; bank has not confirmed
Source page: https://vaultx.llc/hacks/french-bank-crypto-theft-november-2023 · VaultX incident report by Sentinel · first published 2026-11-04, updated 2026-11-04
- Date: 2023-11-01
- Reported loss: $133M (reported 'over $133M' by on-chain investigator ZachXBT (first estimate over $106M, then +$27M); not confirmed by the bank; could be higher if OTC transactions were not counted)
- Attribution: Unknown. No perpetrator has been publicly identified. ZachXBT identified the suspected victim, not the attacker. ZachXBT's 'working theory' was that a large Western European financial institution was exploited and was covering up the breach.
- Chains: Ethereum (reported, via ETH conversion), Not fully specified in reporting; funds left centralized exchanges and moved on-chain
- Status: developing
- Severity: 55/100
- Response score: 30/100 (The alleged victim stayed silent and made no confirmation or disclosure in the reporting reviewed. Kraken's account restrictions and law-enforcement cooperation are the only reported protective steps.)
On-chain investigator ZachXBT reported suspicious exchange withdrawals of over $106M, later revised to over $133M, which he linked to a Western European financial institution. On 4 November 2023 he named French cooperative bank Crédit Mutuel Arkéa as the suspected victim. According to the coverage reviewed, the bank had made no public statement and had not confirmed its involvement. Kraken reportedly restricted accounts tied to the flows and cooperated with law enforcement. The initial access method has not been disclosed.

**What happened**
According to ZachXBT, as reported by Cointelegraph, Crypto Briefing and LCX, large withdrawals were made on 1-2 November 2023 from accounts at centralized exchanges, reportedly Kraken, Crypto.com and OKX. He first estimated over $106M, then raised this to over $133M after finding a further $27M in withdrawals. Reports say the true figure could be higher because possible OTC transactions were not counted.
The funds moved mostly as USDC and USDT, and a large portion was reportedly swapped into ETH within hours. One summary of the reporting also mentions conversion into Monero and the use of instant exchanges. That claim appears in a single summary and is not corroborated elsewhere in the material.
ZachXBT initially described the victim only as a large Western European financial institution. He accused it of covering up the breach and not reporting it to EU authorities. On 4 November 2023 he named French banking group Crédit Mutuel Arkéa, which reports describe as having about $235 billion in assets. Cointelegraph, LCX and Crypto Briefing say the bank did not respond to requests for comment and issued no statement as of 4 November. The allegation is unconfirmed.
Note on dating: one research summary placed the event in November 2026. That conflicts with the case brief and with the contemporaneous coverage, which dates the withdrawals to 1-2 November 2023. This report uses 2023. Research items on a large Binance incident in late 2026 are a separate matter and are not part of this case.

**How it worked**
The initial compromise method has not been disclosed. According to reporting citing Bitquery's analysis, the transfers from exchange accounts into multiple wallets suggest the attacker likely held the victim's credentials or device access. The same reporting says 11 of 15 wallets had used the same exchanges before the theft, and eight of the compromised wallets were Trust Wallet smart accounts.
The reconstruction in the reporting runs as follows. Funds were withdrawn from exchange accounts linked to the victim and sent mostly as USDC/USDT into several wallets. A large part was then swapped into ETH within hours. This is an analyst inference, not a confirmed root cause.

**Where the money went**
Reportedly withdrawn from exchange accounts at Kraken, Crypto.com and OKX as USDC/USDT, moved into multiple wallets, then largely swapped into ETH within hours. One summary mentions Monero and instant exchanges (single-source, unconfirmed). Kraken reportedly restricted linked accounts, but no confirmed amount frozen or recovered has been published.

**The response**
Crédit Mutuel Arkéa made no public statement as of 4 November 2023 and, per Cointelegraph, did not reply to requests for comment. No paused withdrawals, customer compensation program or insurance payout were reported for this case. Kraken reportedly restricted accounts associated with the flows and cooperated with law enforcement. The coverage reviewed identifies no regulator or police announcement (e.g. ACPR, AMF, French prosecutors).

**Impact**
Market impact appears limited to the stolen funds moving through exchanges and being swapped into other assets. There is no report of customer-facing disruption at the bank. Commentary was mainly skeptical of, and critical of, the bank's silence while the flows were tracked on-chain.

**Timeline**
- 2023-11-01 Suspicious withdrawals begin, reportedly from Kraken, Crypto.com and OKX accounts (reported window 1-2 Nov 2023).
- 2023-11-02 Withdrawals continue; ZachXBT's first estimate is over $106M, and some activity reportedly continues after his warning.
- 2023-11-04 By this date ZachXBT has raised the estimate to over $133M and publicly named Crédit Mutuel Arkéa as the suspected victim. He alleges a cover-up. The bank issues no statement and does not respond to media requests.
- 2023-11-04 Kraken reportedly restricts accounts tied to the suspicious flows and cooperates with law enforcement.

**How to protect yourself**
- Institutions holding crypto on exchanges should enforce hardware-backed authentication, withdrawal allowlists, per-account limits and alerts on large outflows.
- Credential and device compromise appears to be a plausible vector. Isolate the devices and keys used for treasury operations and review smart-account permissions.
- Prompt, transparent disclosure to regulators and counterparties helps exchanges freeze funds sooner; silence allows laundering to proceed.
- Treat on-chain sleuth allegations as unconfirmed until the named party or authorities confirm them, and check who is attributing what.

**Still unknown**
- Whether Crédit Mutuel Arkéa was in fact the victim, as the bank has not confirmed.
- The initial access method and the true root cause.
- The full loss, including any OTC transactions, and the exact chain-by-chain flows.
- Attacker identity and attribution.
- Amounts frozen or recovered, including at Kraken.
- Whether any regulator or law enforcement body opened a formal investigation.
- Whether Monero conversion occurred (single-source mention).

**Sources**
- Cointelegraph - ZachXBT: French bank Crédit Mutuel Arkéa $133M crypto theft https://cointelegraph.com/news/zachxbt-french-bank-credit-mutuel-arkea-133m-crypto-theft
- Crypto Briefing - ZachXBT Crédit Mutuel Arkéa $133M exploit https://cryptobriefing.com/zachxbt-credit-mutuel-arkea-133m-exploit/
- LCX - ZachXBT identifies French bank as alleged victim of $133M crypto theft https://lcx.com/en/cryptonews/zachxbt-identifies-french-bank-as-alleged-victim-of-133m-crypto-theft
- LCX - Suspected EU crypto theft estimate rises to $133M https://lcx.com/hr/cryptonews/suspected-eu-crypto-theft-estimate-rises-to-133m-zachxbt
- Cryptopolitan - ZachXBT accuses European institution of cover-up https://www.cryptopolitan.com/zachxbt-accuse-european-institution-cover-up/
- NewsBytes - ZachXBT says suspected $133M crypto theft involves European firm https://www.newsbytesapp.com/news/business/zachxbt-says-suspected-133-million-crypto-theft-involves-european-firm/tldr
- Odaily newsflash https://www.odaily.news/en/newsflash/530481
- PANews Lab https://www.panewslab.com/ko/articles/01a1a461-5172-7045-8300-5115b4890d30
- CryptoNews: ZachXBT-related reporting on the EU entity theft https://cryptonews.net/news/security/33690858/
- Crypto.news: ZachXBT alleges cover-up as suspected crypto theft tops $133M https://crypto.news/zachxbt-alleges-cover-up-as-suspected-crypto-theft-tops-133m/
- Cointelegraph via TradingView: Suspected EU crypto theft estimate rises to $133M https://www.tradingview.com/news/cointelegraph:93c23ada8094b:0-suspected-eu-crypto-theft-estimate-rises-to-133m-zachxbt/?mobileapp_new=true
- BeInCrypto: EU entity $106 million crypto exchange hack https://beincrypto.com/eu-entity-106-million-crypto-exchange-hack/
- Altcoin Buzz: ZachXBT traces $106M suspected theft through ETH and Monero https://www.altcoinbuzz.io/zachxbt-traces-106m-suspected-theft-through-eth-and-monero
- Coinpedia: EU entity suspected of losing $106M in crypto exchange heist https://coinpedia.org/news/eu-entity-suspected-of-losing-106m-in-crypto-exchange-heist-zachxbt/

---
VaultX: free crypto news and intelligence, https://vaultx.llc