Crédit Mutuel Arkéa was linked to a $133 million crypto theft after two days of silence

Blockchain investigator ZachXBT said the French bank Crédit Mutuel Arkéa was the company behind a theft of more than $133 million in USDC and USDT, and accused it of not disclosing the incident quickly enough for law enforcement and stablecoin issuers to freeze part of the funds. For high-risk operators and PSPs, the point is simple: delayed incident reporting can turn a contained breach into a settlement-and-recovery problem.

1. On Monday, November 2, ZachXBT first reported the attack, saying an unknown European company had lost more than $106 million in USDC and USDT. He said the attacker swapped USDC into ether, moved the assets through exchanges, and converted part of the proceeds into Monero, with the attack unfolding over several days.
2. ZachXBT later said the attacker had withdrawn another $27 million from the company’s accounts, bringing the total loss above $133 million. He also published four Ethereum addresses that he said were connected to the theft.
3. On Wednesday, November 4, ZachXBT wrote in his Telegram channel that the victim was Crédit Mutuel Arkéa, a French bank that manages $235 billion in assets. He did not say how he identified the bank or how the attacker gained access to the exchange accounts.
4. ZachXBT said the bank’s delay in reporting the incident meant law enforcement and stablecoin issuers could not freeze at least part of the stolen funds. In response, Crédit Mutuel Arkéa said its customers were not affected and that its security teams had brought the situation under control and taken steps to prevent further unauthorized transfers.
5. The bank had already signaled in May that it was preparing to work with crypto assets. French media reported that it had applied for a license under the EU’s MiCA (Markets in Crypto-Assets) framework and planned to offer crypto services to retail clients through its Arkéa Banking Services unit.

For context, this is not ZachXBT’s first public postmortem in October alone: he attributed a $3.8 million theft to the crypto project Near Intents, after which NEAR fell more than 8%, and he also accused India’s CoinDCX of losing $16 million of user funds.