French banking group linked to $133 million crypto theft claim
A French mutual bank is at the centre of one of the largest alleged cryptocurrency thefts involving a traditional financial institution, according to a Nov. 5 report by The Block. Crédit Mutuel Arkéa is said to have lost more than $133 million in a multiday attack targeting accounts held at centralized exchanges, an unverified on-chain estimate that has nonetheless rippled through digital asset markets.
The figure comes from ZachXBT, the independent blockchain investigator whose wallet tracing has repeatedly surfaced major exploits before any official disclosure. On Nov. 2 he put losses above $106 million. Days later, after tracing further suspicious withdrawals, he added another $27 million to the tally. He has cautioned that the total may ultimately prove higher because the investigation is still ongoing.
Arkéa itself has neither confirmed nor denied the incident. No law enforcement agency had formally established the loss when The Block published, and no attacker had been identified. Until that changes, the numbers should be read as an on-chain estimate rather than a verified bank loss. That caveat, however, has not stopped the market from drawing conclusions about what the case says about institutional crypto risk.
For broader context on how quickly exploit news moves prices and policy, see our Bitcoin coverage and related security reporting.
How the funds moved, and why that matters
According to The Block’s account of ZachXBT’s findings, the funds were withdrawn in USDC and USDT, the two largest dollar-pegged stablecoins by circulation. The attacker then swapped part of the proceeds into Ether and Monero and moved assets across several blockchains.
Each element of that trail carries weight. Stablecoins are the settlement rails of the crypto economy, used constantly for legitimate liquidity provision, trading collateral and cross-border transfers precisely because they combine dollar pricing with near-instant blockchain finality. The same properties that make them efficient also make them attractive to thieves. A withdrawal denominated in USDC or USDT can move between wallets, exchanges and chains within minutes, without a correspondent banking layer that might otherwise slow or flag the transfer.
The swap into Ether adds another layer. ETH is deeply liquid and universally accepted across exchanges and decentralised protocols, so converting stablecoins into it rarely triggers unusual market impact. Monero is different. The privacy coin obscures sender, receiver and amount by default, which makes it one of the hardest assets to trace once funds enter its network. The fact that only part of the proceeds was moved into XMR suggests the attacker is balancing two competing needs: liquidity and anonymity.
Cross-chain movement compounds the tracing problem. Bridge hops and multi-chain dispersal can fragment a single theft into dozens of addresses across ecosystems with different explorers, consensus rules and compliance tooling. Investigators must reassemble the picture manually. ZachXBT’s ability to do so, and to publicise incremental findings while the attack was still unfolding, is precisely what allowed the estimated total to grow from $106 million to beyond $133 million within days.
Not Lazarus, and why attribution changes everything
Perhaps the most consequential finding in the report is negative. ZachXBT said he was “highly confident” the attacker is not connected to Lazarus Group, the North Korean state-linked hacking operation behind several of the largest cryptocurrency thefts on record.
That distinction is not academic. Attribution shapes the entire aftermath of a major crypto breach. When Lazarus is implicated, Western sanctions regimes activate, exchanges and stablecoin issuers move to freeze flagged addresses, and international law enforcement coordination typically follows through channels established for state-sponsored financial crime. Frozen issuer-controlled wallets can sometimes render stolen USDT or USDC unusable before they are laundered.
A non-state attacker faces a different calculus. There may be no sanctions hook, no pre-existing investigative framework and fewer frozen assets. On the other hand, a criminal without state protection is more exposed to conventional policing: identification, arrest, extradition and seizure all become plausible. Recovery odds can, paradoxically, be better in non-state cases if investigators get a clean lead.
The unverified status of the attribution cuts both ways. ZachXBT’s track record earns credibility, but The Block was clear that no one had independently confirmed the theft or the total when its report ran. Readers should hold both possibilities: that the on-chain trail is accurate but incomplete, and that a formal disclosure from Arkéa could reshape the figures.
What the case signals for banks, stablecoins and investigators
If even the lower estimate holds, the incident ranks among the significant breaches of the year and lands squarely in a grey zone that regulators have spent 2024 and 2025 arguing about: how traditional financial institutions should hold and safeguard crypto assets.
French banks operate under some of the stricter licensing regimes in Europe. The EU’s Markets in Crypto-Assets framework now requires authorised custodians and imposes operational resilience obligations on firms touching digital assets. A nine-figure loss at a French mutual bank, once confirmed, would almost certainly prompt supervisory questions about how exchange-based accounts of that size were secured, whether segregation and withdrawal controls were adequate, and what monitoring existed for anomalous transfers.
The stablecoin dimension will draw equal scrutiny. USDC and USDT issuers can freeze tokens at their contract level, a power exercised after major exploits. But freezing is reactive, and it works poorly once funds have been swapped into native assets like ETH or XMR on chains the issuers do not control. Every large theft settled in stablecoins renews the debate over whether issuer blacklisting is a meaningful systemic safeguard or a patch that sophisticated attackers route around within hours.
There is also a market angle. Theft news concentrated at a single institution rarely moves liquid crypto prices on its own. What it moves is risk perception. Institutional adoption narratives lean on the idea that regulated banks bring institutional-grade custody to digital assets. Reports of a $133 million hole in a bank’s crypto exposure feed the opposite story: that the weak point remains the interface between regulated finance and exchange-held keys.
Finally, the case cements the role of independent investigators. ZachXBT published findings on Nov. 2, three days before The Block’s report, while the bank stayed silent and authorities made no statement. Whether the eventual total matches, exceeds or falls short of $133 million, the information asymmetry has already been corrected in public. That is a structural change in how crypto fraud becomes news.
The short read
Treat the number as provisional. Arkéa has not confirmed anything, no authority has verified the loss and the attacker is unidentified. What is solid is the method: a public on-chain trail, an evolving total, a careful exclusion of Lazarus and an implicit warning about exchange-account security at banks. If Arkéa breaks its silence, expect the figure to be refined and European supervisors to take an interest. Until then, this is the largest unverified crypto theft claim of its kind, and a live test of how quickly blockchain evidence can outpace official disclosure.
