$133M Crypto Theft Claim: Crédit Mutuel Arkéa Confirms Cyberattack, but Not Crypto Losses

French banking group Crédit Mutuel Arkéa has confirmed it suffered a cyberattack that enabled “fraudulent operations,” shortly after onchain investigator ZachXBT named it as the alleged victim of a crypto theft worth more than $133 million. The bank’s statement, as reported by Decrypt, did not mention cryptocurrency and said it is still assessing the amounts involved.

How the $133M figure grew

The estimate climbed over three days. On Monday, ZachXBT flagged more than $106 million in suspicious withdrawals from centralized exchanges. By Tuesday he had raised the total to over $133 million after finding roughly $27 million in further withdrawals, some of which happened after his first warning. On Wednesday he identified the bank as the alleged victim, describing it as an institution with about $235 billion in assets that was exploited over several days.

He also cautioned that the real number may be higher. “I suspect the amount stolen is larger when accounting for OTC activity,” he said, suggesting that over-the-counter deals were not captured in the earlier tallies.

What the bank has and hasn’t said

The gap between the bank’s wording and ZachXBT’s claims is the key point. Crédit Mutuel Arkéa acknowledged an attack and fraud, but its statement, as Decrypt describes it, stops short of confirming that digital assets were taken or that it is the source of the funds ZachXBT traced. The two outlets also differ on timing: Cointelegraph said the bank had not responded to its request for comment when it published, while Decrypt reported the confirmation afterward.

Cointelegraph noted that the bank’s alleged involvement had not been independently verified. ZachXBT has also not explained how the attackers got access to the funds, so the method of intrusion is unknown.

Exchanges respond as funds move

Blockchain analytics firm Bitquery traced withdrawals from accounts at Kraken, Crypto.com and OKX. It found that about $63 million in stablecoins was swapped into Ether within four hours. Swapping out of stablecoins is significant because issuers can freeze them, whereas Ether cannot be frozen the same way.

Kraken and Crypto.com later told Cointelegraph they had restricted accounts or blocked funds tied to the suspected theft. Both said their platforms remained secure. The sources do not say whether OKX took similar action, and they do not report any recovery of funds.

What remains unclear

Several questions are still open. The bank has not said whether the fraudulent operations involved crypto, how much was lost, or how the attackers got in. ZachXBT’s numbers are an onchain investigator’s estimates, not audited losses, and he says they could rise. Until Crédit Mutuel Arkéa finishes its assessment or authorities weigh in, the link between the bank’s confirmed cyberattack and the $133 million in traced withdrawals rests on the investigator’s analysis.

For now, the case shows how quickly stolen crypto can move through major exchanges and how much of the early public picture comes from independent trackers rather than the institutions affected. Any further statement from Crédit Mutuel Arkéa, or from the exchanges that froze funds, should clarify how large the loss is and whether any of it can be recovered.

Explore more on this topic with Vexel Search.

File photo: Accueil du siège social du Crédit Mutuel Arkéa.jpg by FJaffres, CC BY-SA 4.0, via Wikimedia Commons.