Crédit Mutuel Arkéa Named in Alleged $133M Crypto Theft

On-chain investigator ZachXBT has named French bank Crédit Mutuel Arkéa as the alleged victim of a $133 million crypto theft, according to a Decrypt report dated 4 November 2026. The claim is an allegation, and the coverage available to us does not establish how the loss occurred. For accounting teams, the useful question is not who did it but whether your crypto accounting software and controls could handle a loss of this size without a scramble.

What has been reported, and what has not

The facts we can state

Decrypt reports that ZachXBT, a well-known blockchain sleuth, identified Crédit Mutuel Arkéa, a French banking group, as the alleged victim of a theft valued at $133 million. That is the full extent of what we can responsibly repeat. The source text we reviewed was dominated by website cookie notices, so it gave us no further detail on the mechanism, the assets, the wallets, or any response from the bank.

What remains unconfirmed

We have no confirmed information on whether the funds were client assets or the bank's own holdings, whether a regulator has been notified, or whether any recovery is under way. We also cannot say which blockchains or tokens were involved. Treat every one of those points as open until the bank, a regulator, or law enforcement says otherwise. Firms writing internal memos on this story should label it clearly as an unverified allegation.

Why a bank-side allegation matters to crypto accounting teams

Custody risk is not limited to crypto-native firms

Recent enforcement coverage has centred on exchange hacks and state-linked laundering. A report that a bank may be on the receiving end widens the picture. Banks and other regulated institutions increasingly touch digital assets through custody, treasury, tokenised products or client services. Wherever private keys, signing infrastructure or third-party custodians sit, the same class of loss event is possible. Auditors and CFOs at traditional institutions should not assume their control environment is different in kind just because their balance sheet is mostly fiat.

The ledger has to tell the story quickly

When a theft is alleged, the first questions from a board, auditor or supervisor are factual and urgent. Which wallets and addresses were involved? What was the balance at the last reconciled point? What moved, when, and to where? A system that keeps wallet-level balances, transaction hashes and timestamps tied to the general ledger can answer those questions in hours. A spreadsheet that is reconciled monthly may not be able to answer them at all. This is the practical case for dedicated crypto bookkeeping software: it keeps an auditable trail between on-chain activity and the books.

Accounting treatment questions a loss raises

Recognition, measurement and presentation

The right treatment depends on facts we do not have, and on the reporting framework the entity applies. Several questions will come up for any holder of digital assets that suffers a suspected theft:

• Was the asset the entity's own, or held on behalf of clients, and does the entity control it for reporting purposes?
• At what date did the entity lose control, and what was the carrying amount then?
• Is there a realistic prospect of recovery, through insurance, the custodian, law enforcement action or freezing by issuers, and does that justify recognising any receivable or only disclosure?
• Does the event require disclosure as a subsequent event if it occurs after the reporting date but before the statements are authorised?

Firms should agree the answers with their auditors under the framework they actually report under, rather than rely on commentary about a single unconfirmed incident. For teams building a response playbook, our earlier piece on accounting steps after a withdrawal halt covers the practical sequence for documenting an incident.

Tax and AML angles

From a tax standpoint, whether a theft loss is deductible, and in which period, is a jurisdiction-specific question that turns on the facts and on local rules. Nothing in the report tells us how French authorities would view this case, so we do not speculate. What a finance team can do is preserve the evidence a tax adviser would need: acquisition cost records, the date and value at loss, police or regulator reports, and any correspondence with custodians.

On the AML side, stolen funds that move on-chain create screening risk for everyone downstream. If addresses linked to a theft are later published, firms that receive funds from them, even indirectly, may need to escalate. Tools that let you screen counterparties against published blocklists, and retain the screening record, reduce that exposure. Our coverage of how crypto accounting software helps firms spot hack exposure sets out how to trace whether your wallets touched flagged addresses.

Practical steps for firms and CFOs this week

Test your own readiness

You do not need to wait for confirmation of this specific case to run a short drill. Ask your team to produce, within one working day, a wallet-by-wallet position as at a recent date, with transaction hashes supporting every movement over a set period. If that takes longer than a day, the gap is the finding. Digital asset accounting software that ingests on-chain data directly and maps it to ledger accounts shortens that exercise considerably.

Review third-party and key-management dependencies

List every custodian, wallet provider and signing service you rely on, along with who holds which keys and what approval thresholds apply. Check whether your contracts and insurance policies actually cover theft of digital assets, and under what conditions. Confirm that your incident plan names who contacts the regulator, the auditor and, where relevant, law enforcement, and in what order.

Prepare the documentation pack

If a loss ever occurs, you will want a ready-made pack: a dated balance snapshot, the transaction trail, valuation sources, the control environment description, and a timeline of internal decisions. Building the template now is cheaper than building it during an incident. It also helps you respond consistently if multiple stakeholders ask for different cuts of the same data.

What to watch next

Look for a statement from Crédit Mutuel Arkéa, any confirmation from French or European authorities, and on-chain analysis that publishes the addresses involved. Each would let firms move from general readiness to specific screening and, if relevant, specific disclosure analysis. For regulated European entities, our crypto compliance reporting hub collects the reporting and AML context that sits around events like this.

Until then, the honest position is narrow: a prominent investigator has made a claim about a large loss at a bank, and the details are not yet public in the coverage we reviewed. The sensible response for accounting teams is to strengthen the controls and records that would matter if the claim holds, without building conclusions on facts nobody has confirmed.

FAQ

Has Crédit Mutuel Arkéa confirmed the $133M theft?

The coverage we reviewed describes it as an allegation made by ZachXBT. It did not include a confirmation from the bank, so treat the claim as unverified until the bank or an authority says otherwise.

Why does this matter to a firm that does not hold crypto for clients?

Any entity with digital assets on its balance sheet faces custody and key-management risk. The story is a prompt to test whether your records could support a loss assessment, an audit query or a regulator request quickly.

What should crypto accounting software be able to show after a suspected theft?

It should provide wallet-level balances at a chosen date, a transaction trail with hashes and timestamps, valuation sources, and a link between on-chain movements and ledger entries. That lets teams quantify the loss and evidence it for auditors.

Can a stolen-asset loss be deducted for tax?

It depends on the jurisdiction, the facts, and the entity type. Take advice locally, and preserve cost records, loss dates and official reports so the position can be supported.

How does this connect to AML obligations?

If stolen funds are traced to specific addresses, counterparties that later receive them may face screening alerts. Keeping a record of address screening and escalation decisions helps demonstrate a functioning control.

Source: Decrypt