ZachXBT Said a Western European Institution Was Hiding a $133M Hack

On Monday, nobody knew who had lost the money. By Wednesday morning the victim had a name, a statement and a lot of questions to answer.

It started on November 2, when ZachXBT posted an alert to his Telegram channel. An unnamed EU entity, he said, had lost more than $106M from several centralized exchange accounts the day before. The attacker pulled everything out as USDC and USDT, then began swapping to ETH, hopping through instant exchanges and converting some of it to Monero. He published 11 addresses. DEGEN NEWS had the alert on X within hours, and Wu Blockchain relayed it too.

A day later the number was $133M. ZachXBT had found another $27M in exchange withdrawals, some of them made after his first post. His working theory was that a large financial institution in Western Europe had been exploited and that it was "currently being covered up." What annoyed him most was the timing. In his telling, more than $30M got laundered that EU law enforcement could have frozen if the incident had been properly disclosed.

Late on November 3 he named the institution: Crédit Mutuel Arkéa, a French cooperative bank with roughly €211.5B in assets and more than 5.6M customers. He said the attack ran over several days. "I suspect the amount stolen is larger when accounting for OTC activity," he added.

The Bank Answers

The "still hiding it" part of the story didn't last long. On November 4, Arkéa told French outlets, including Cryptoast and France Télévisions, that it had suffered an attack that allowed fraudulent operations. It said the incident is now contained, that customers face no financial consequences, and that some transactions were suspended temporarily. It gave no loss figure and no explanation of how the attackers got in.

So the bank admitted an incident within a day of being named. Whether it told EU authorities before the money moved is a separate question, and I haven't seen anything that answers it either way.

Maybe It Wasn't Crypto That Was Stolen

This is where it gets strange. Per Cryptoast, journalist Grégory Raymond reported that the money may have left the bank as plain fiat and only turned into crypto afterwards, as the laundering step. His source described an organized network of mule accounts. French reports tied the fraud to Fortuneo, Arkéa's online bank. One source floated two explanations: a compromise of Fortuneo's payment systems, or a social engineering job in the style of CEO fraud. A separate account says the funds went to exchange accounts opened with fake identities that got past KYC. Bitquery's read of the on-chain data points toward the attacker controlling the exchange logins. None of this is confirmed, and the accounts don't fit neatly together.

The size is also still fuzzy. $133M is about €118M. Some French coverage says "more than €100M." ZachXBT thinks the real total is higher.

What The Chain Shows

Bitquery traced $108.8M in USDC leaving accounts at Kraken, Crypto.com and OKX across about 21 hours. In one four-hour window, roughly $62.98M in stablecoins was converted into 27,553 ETH. At 13:47 UTC on November 2, about $78.3M still sat in attacker-linked wallets, $30.5M had already left the tracked addresses, and only $3.74M was USDC that Circle could freeze.

Kraken says it restricted accounts linked to the incident. Crypto.com says it blocked related funds. Both say their own platforms weren't compromised. OKX was reported to be reviewing the allegations.

Both statements may well be true. Still, 21 hours is a long time for $100M+ to walk out of accounts at three big venues that all run compliance teams.

ZachXBT also says with a "high degree of confidence" that this is not Lazarus. The laundering path is different, with instant exchanges, Wagyu for the Monero conversion and a lot of chain hopping. The timing makes it conspicuous: it comes days after the Binance hack of roughly $6.4B, which the FBI attributed to North Korea's TraderTraitor group. This one is smaller and messier, and nobody has a name for the attacker.

What's Still Open

The amount, the method and the identity of the attacker are all unconfirmed. Arkéa says normal operations will resume once final security checks are done. Whether any of the remaining funds can be clawed back depends on how much is still sitting in those wallets, and that number was moving fast.