The biggest crypto theft of the week didn’t start at a crypto company. It started — allegedly — at a French bank with 5.8 million members and customers. On November 4, 2026, Crédit Mutuel Arkéa confirmed that a cyberattack had allowed “fraudulent operations,” one day after on-chain investigator ZachXBT named it as the likely source of more than $133 million drained through crypto exchange accounts.
The bank says the incident is closed. ZachXBT says it was covered up. Both can’t be entirely right.
Key facts
- On November 2, 2026, ZachXBT flagged an unnamed EU entity that may have lost more than $106 million from accounts at several crypto exchanges on November 1; a day later he found $27 million more, for a total above $133 million.
- On November 3 he named Crédit Mutuel Arkéa as the alleged victim; on November 4 the bank confirmed a cyberattack but did not mention crypto or give a figure.
- Bitquery traced withdrawals through accounts at Kraken, Crypto.com and OKX; about $62.98 million in stablecoins was converted into 27,553 ETH within roughly four hours.
- Kraken restricted linked accounts and Crypto.com blocked related funds; Tether froze $1.1 million in USDT, while only $3.74 million in USDC was within Circle’s reach.
- According to ZachXBT, the attacker swapped USDC into ETH, used instant exchanges and bridges, and converted part of the funds into Monero; he says with “a high degree of confidence” it is not North Korea’s Lazarus Group.
- ZachXBT says about $30 million could have been frozen with timely disclosure; the bank says it informed supervisors immediately.
What happened at Crédit Mutuel Arkéa?
In its statement of November 4, Crédit Mutuel Arkéa said a cyberattack allowed fraudulent operations, that the incident is “closed and under control,” and that customer assets were not affected — the attack only delayed some transfers. It said it notified supervisors on detection, temporarily suspended some transactions and warned customers about phishing. The amounts are still being assessed but, according to the bank, are not of a size that would threaten the group, which reports €211.5 billion in total assets.
The bank did not say whether crypto was involved. That link comes from ZachXBT, who said on Telegram that the victim is “allegedly Credit Mutuel Arkea” and that the attack ran over several days. He has not said how he identified the bank or how the attacker got into the accounts.
How the money moved
Per Decrypt and Cointelegraph, funds left exchange accounts as USDC and USDT. Bitquery counted about $62.98 million in stablecoins swapped into 27,553 ETH within about four hours; by Monday afternoon roughly $78.3 million still sat in attacker-linked wallets. ZachXBT says the attacker then used instant exchanges, cross-chain bridges and Monero, and published four Ethereum addresses tied to the theft.
The first move was out of the stablecoins that can be frozen.
Why did freezes recover so little?
Because speed beat disclosure. USDC and USDT can be frozen by their issuers, but only while they are still USDC and USDT. Within hours, most of the stablecoins had become ether, which no issuer controls. By the time the case was public, Circle could reach only $3.74 million and Tether had frozen $1.1 million — under 4% of the total.
Exchanges acted on what was left on their platforms. Kraken said the incident did not originate on Kraken, its systems were not compromised and no customer accounts were taken over, but it restricted linked accounts and is working with law enforcement. Crypto.com said it blocked related funds and that “all user funds are secure and accessible.” OKX said it was looking into the matter.
ZachXBT’s accusation is that the window closed because the victim stayed quiet: he says about $30 million could have been frozen with proper disclosure. The bank says supervisors were informed right away. Notifying a regulator and alerting stablecoin issuers and exchanges are not the same thing — and in crypto, only the second one stops funds.
Does this affect bank or exchange customers?
According to the bank, customer assets were not affected. Kraken and Crypto.com both said ordinary customers are not at risk; their freezes target accounts and flows linked to the attacker. The broader point is about banks entering crypto: Arkéa applied for a MiCA licence in May to offer crypto services to retail customers, per L’Agefi. Statutory deposit insurance does not cover crypto assets, and MiCA requires licensed providers to hold client crypto separately from their own.
What this means for swap users
When stolen money flows through instant exchanges, the services and liquidity providers behind them screen deposits against flagged addresses. If coins you send are linked to a theft — even several hops back — a swap can be held for review instead of completing. That’s a real trade-off, and it’s why it pays to know where your coins came from. Our explainer on what Chainalysis can see on-chain shows how such links are made.
Two habits help: don’t accept crypto from strangers as “payment” for anything you can’t verify, and always set a refund address on a SwapZilla swap so a held transaction can be returned to you. If you hold stablecoins, the case is another reminder of the freeze power USDT and USDC issuers have — which cuts both ways.
Final thoughts
A $133 million theft from a bank, laundered in hours through ETH, bridges and Monero, is the kind of case that will shape how European regulators think about banks offering crypto under MiCA. The on-chain trail was public within a day. What the industry still lacks is a fast, standard way for victims to tell issuers and exchanges “freeze this” before the stablecoins turn into something nobody can freeze.