Onchain investigator ZachXBT says a French banking group, Crédit Mutuel Arkéa, has allegedly been targeted in a crypto theft that he estimates at more than $133 million—though he cautions that the real figure could be higher once certain off-platform activity is considered. The claim, shared via ZachXBT’s public investigation channel, comes after an earlier report pointing to a rapidly growing set of suspicious withdrawals.
ZachXBT said the alleged incident unfolded over multiple days and described the institution as having $235 billion in assets. He also argued that prior loss estimates may not fully reflect over-the-counter (OTC) transactions, which he believes could have enabled additional leakage of funds not captured in earlier accounting.
Key takeaways
- ZachXBT alleges Crédit Mutuel Arkéa was exploited in a crypto theft exceeding $133 million, with potential for greater losses.
- The investigator suggested OTC activity may not have been included in earlier totals, implying the headline figure could be understated.
- The specific method used by attackers to access funds has not been disclosed, and the claim has not been independently verified.
- Earlier ZachXBT reporting identified over $106 million in suspicious exchange withdrawals before losses were later raised above $133 million.
- Kraken and Crypto.com told Cointelegraph they restricted accounts or blocked funds tied to the suspected theft while asserting their platforms remained secure.
Allegations expand beyond initial estimates
According to ZachXBT’s latest post, he identified Crédit Mutuel Arkéa as the alleged victim of a crypto theft involving withdrawals that occurred across several days. In the update, he referenced the institution’s scale—describing it as holding $235 billion in assets—while warning that the true losses may exceed what has been calculated so far.
The most significant new element is ZachXBT’s emphasis on OTC-related activity. He stated that he suspects the stolen amount is larger when OTC transactions are considered, suggesting that earlier numbers may have focused primarily on activity traceable through public exchange flows.
As with previous investigation rounds, ZachXBT did not provide details about how attackers allegedly gained access to funds. He also did not independently confirm the bank’s involvement through a verifiable incident response process, meaning the allegation remains unverified publicly.
Timeline of disclosures: from $106M to $133M+
The latest development follows a progression of ZachXBT’s reporting over the past few days. In a Monday report, he flagged what he described as over $106 million in suspicious withdrawals from centralized exchanges. Then, on Tuesday, he revised his estimate upward to over $133 million after discovering another $27 million in withdrawals—some of which, according to ZachXBT, occurred after his initial warning.
This step-by-step revision is important for readers tracking the case, because it highlights how quickly numbers can change when investigators continue to correlate transactions and expand the scope of what they believe is connected to a suspected exploit. It also underscores why initial figures in onchain investigations are often provisional until the full transaction graph is mapped.
What blockchain tracing previously pointed to
In connection with the theft narrative, blockchain analytics firm Bitquery previously traced withdrawals from accounts at Kraken, Crypto.com, and OKX. Bitquery’s findings indicated that roughly $63 million in stablecoins were converted into ether (ETH) within four hours—an operational detail that may help explain how quickly attackers could shift assets out of initial on-exchange custody.
Fast conversion from stablecoins into a more liquid asset can matter in investigations because it can reduce the time available for intermediaries to freeze funds, and it can complicate tracking by increasing the number of potential downstream transfers.
Exchange responses and the gap in independent verification
When Cointelegraph contacted Kraken and Crypto.com regarding the incident, both exchanges said they restricted accounts or blocked funds associated with the suspected theft. At the same time, they told Cointelegraph that their platforms remained secure.
The distinction between “platform security” and “account access” is likely to remain central as more details emerge. If an attacker obtained control of funds through compromised credentials, internal access, or other offchain mechanisms, exchanges can still operate normally while the affected party remains responsible for securing the systems that interact with trading infrastructure.
Cointelegraph also attempted to obtain comment from Crédit Mutuel Arkéa but reported that it had not received a response by publication. Additionally, ZachXBT’s allegation about the bank has not been independently verified, and the investigator has not publicly described the attack vector.
For investors and operators, the uncertainty around attribution and method is more than a technicality. Until there is verified confirmation, discussions around potential market impact, insurer exposure, and broader systemic risk remain speculative.
Readers should also keep in mind that OTC routes can blur the line between what is visible in exchange-centric flows and what is moved elsewhere. If ZachXBT’s OTC concern is correct, the gap between traced onchain activity and the bank’s ultimate loss figure may persist for some time.
Why the OTC angle matters next
The question of whether OTC activity was involved—and how much it could add to the total—may shape how the case is understood. OTC trades can involve different counterparties, settlement structures, and reporting pathways than exchange transactions, making them harder to capture in public transaction graphs.
Over the coming days, the key things to watch are whether additional investigators corroborate ZachXBT’s scope (especially around OTC), whether Kraken, Crypto.com, and other venues provide further detail about actions taken, and whether Crédit Mutuel Arkéa responds with an official assessment of what occurred.
