French bank Crédit Mutuel Arkéa has confirmed a cyberattack in which fraudulent transfers left the bank's own account and ended up in cryptocurrencies through specialized platforms. The scale is likely above USD 133 million.
Crédit Mutuel Arkéa is a French bank with more than 12,000 employees and more than 5.8 million members and customers. Its total assets amount to EUR 211.5 billion (USD 238.1 billion), and the online subsidiary Fortuneo belongs to the group. However, ZachXBT, not the bank, made the case public in early November 2026. The independent on-chain investigator reconstructed the trail of the theft on public blockchains. Arkéa confirmed the attack only two days later. The bank said it had contained the incident and that the attack did not touch customer assets. ZachXBT said his USD 133 million estimate could still rise. That is because the attack stretched over several days and may have included further OTC transactions.
Subscribe to our newsletter
The best articles of the week, directly delivered into your mailbox.
Arkéa confirms the cyberattack, not the amount
According to the bank, the attack enabled fraudulent transfers from the institution's own account. The funds eventually moved into crypto through specialized platforms. The sequence stands out, since the on-chain trail was public before the bank issued its statement. For two days, therefore, anyone with access to blockchain data could trace the outflow.
Arkéa confirmed ZachXBT's USD 133 million only as an order of magnitude. Furthermore, the bank said the amount of the fraudulent transactions need not match the final loss. Part of the stolen funds remains blocked, and the bank says it is too early for a final figure. The institution has not said how large the blocked share is. Thus, the bank ultimately leaves open whether the damage falls below or above the investigator's estimate.
Customers felt the incident only as delays to individual transfers, according to the institution. The bank had previously suspended certain transactions as a precaution. By the morning of the confirmation, almost all operations were running again. At the same time, the bank stresses that its teams activated the necessary security measures immediately after discovery. The aim was to prevent further fraudulent movements. Measured against total assets, the amount is comparatively small, as USD 133 million equals around 0.06% of USD 238.1 billion.
"We can already state that the amounts involved are in no way capable of undermining the financial strength and solidity of Crédit Mutuel Arkéa." - Crédit Mutuel Arkéa
How the money left through instant exchanges and Monero
ZachXBT traced the path of the funds on-chain. First, an unidentified European entity withdrew more than USD 106 million from centralized exchanges. Around USD 27 million more followed later, ZachXBT says. The total of more than USD 133 million therefore comes from two waves, and the second was much smaller.
The attacker then swapped the funds from USDC into ETH, among other conversions. Next, the money ran through instant exchanges such as WellWallet and Kyrrex and moved into Monero (XMR) via Wagyu. In addition, the attacker spread parts of the proceeds across several chains through bridges. Each of these steps makes tracing harder. Instant exchanges typically handle individual swaps between two cryptocurrencies directly. The switch to Monero weighs heaviest, because the privacy coin hides addresses and amounts that are openly visible on Ethereum.
Part of the funds was almost out of reach early on. In the investigator's assessment, more than USD 30 million already sat beyond simple freezing routes. He attributes this to a late report to the authorities. USDC's issuer, for example, can block addresses and thus freeze balances, while Ether has no such gatekeeper. Consequently, the final damage also depends on how much the bank actually managed to block. ZachXBT also commented on who is behind the attack. He said he has "high confidence" that the attacker does not belong to North Korea's Lazarus Group. And neither the bank nor the investigator has named a perpetrator so far.
Bitquery measures more narrowly than ZachXBT
The loss figures in circulation come from two measurements, and adding them together would be wrong. The highest comes from ZachXBT, who cites more than USD 133 million. He considers a higher figure possible with further OTC transactions. Two parties negotiate such deals bilaterally, often through specialized intermediaries and outside public order books. As a result, they do not necessarily appear in exchange data. The EUR 118 million cited in some reports equals the same USD 133 million after conversion. It is not a separate measurement.
Data provider Bitquery instead counts USD 108.8 million in USDC withdrawals from wallets it attributes to Kraken, Crypto.com and OKX. The funds went to 15 addresses. The measurement window covers around 21 hours between 01.11. and 02.11.2026. Excluding two only indirectly linked addresses leaves USD 95.7 million. Hence, the scope of each count explains part of the gap, since ZachXBT captures both outflow waves.
On the day of the confirmation, Bitquery still saw around USD 42.6 million in linked Ethereum wallets, mostly in ETH. That portion is at least visible on-chain. However, the measurement has a blind spot. Bitquery does not see bank transfers, so it cannot independently document the route from the bank's account to crypto. As a result, the link between Arkéa and the wallets rests on ZachXBT's reconstruction. It also rests on the bank's statement that funds flowed into crypto. The institution has not confirmed any of these figures as an exact amount.
Service provider platform as the suspected entry point
The bank offers only a brief account of the entry point. By that account, the attackers got into the system through a service provider's platform and sent money to other banks. Yet Arkéa did not confirm whether this route enabled the conversion into crypto. On-chain data do not capture precisely this step. The bank denied any access through its online subsidiary Fortuneo. Likewise, the institution says the attackers did not use customer accounts. Officially, then, the exact method remains unexplained.
The setup of the case is unusual. The victim is the bank itself rather than individual customers or a crypto exchange. Yet the money left through crypto channels. To clarify the origin and method of the attack, Arkéa is working with judicial and police authorities. Moreover, the bank warned of possible phishing attempts. Besides the method, the final loss and the size of the blocked share remain open.
