Crédit Mutuel Arkéa Confirms Cyberattack Amid Alleged $133 Million Crypto Theft

Preface

French banking group Crédit Mutuel Arkéa confirmed that it had suffered a cyberattack that enabled fraudulent operations. The announcement followed allegations by onchain investigator ZachXBT, who identified the bank as the suspected victim of a crypto theft exceeding $133 million. The bank said the incident was under control, customer assets were unaffected, and some transfers had been delayed. However, it did not disclose the amount involved or confirm that cryptocurrency losses occurred. This distinction is central to the story: the bank has acknowledged a cyber incident, while the alleged scale and crypto connection remain unconfirmed by the institution. The account below outlines the bank’s response, ZachXBT’s claims, the reported movement of funds, and the broader context, while keeping confirmed statements separate from allegations.

Lazy bag

Crédit Mutuel Arkéa said a cyberattack enabled fraudulent operations, but described the incident as closed and under control. It reported that customer assets were not affected and that some transfers had been delayed. The bank has not confirmed crypto losses or stated how much money was involved. ZachXBT alleged that the institution was linked to more than $133 million in crypto withdrawals across several days, and suggested the total could be higher when over-the-counter activity is considered. The bank’s confirmation of an attack does not, by itself, verify the investigator’s estimate or account of the funds.

Main Body

Crédit Mutuel Arkéa, a French mutual banking group, confirmed that it had been targeted by a cyberattack that allowed fraudulent operations. The confirmation came a day after ZachXBT, an onchain investigator, publicly named the group as the alleged victim of a crypto theft valued at more than $133 million. The two accounts overlap in describing a security incident, but they differ in what they establish: the bank acknowledged fraudulent activity, while the proposed crypto connection and total losses remain allegations.

In a statement shared with Decrypt on Wednesday, the bank said the incident was “closed and now under control.” It added that operations were gradually resuming after stronger security measures had been put in place. According to the statement, customer assets were not affected, although the attack delayed the execution of some transfers. The bank did not mention cryptocurrency and did not specify how much money was involved.

The bank said it was still assessing the amounts affected. As translated by Decrypt, it stated that the sums were “in any event not of a nature to call into question the solidity and financial health of the group.” This provides the institution’s view of the incident’s financial significance, but does not establish a final loss figure. The bank did not confirm whether any assets were taken from crypto exchange accounts or whether the reported transactions were connected to its systems.

Crédit Mutuel Arkéa said it notified the relevant supervisory authorities as soon as it detected the attack. It also temporarily suspended some transactions as a precaution intended to prevent further fraudulent movements. The group warned customers to be alert to phishing attempts following the incident. Decrypt said it had contacted the bank for additional comment, including clarification on whether the losses involved cryptocurrency.

ZachXBT’s account began with a post on Monday about an unnamed entity in the European Union. He said the entity may have lost more than $106 million from accounts at several cryptocurrency exchanges on November 1. In his initial description, withdrawals were made in USDC and USDT. He said the attacker then swapped USDC for ETH, moved funds through instant exchanges, converted some of the funds into Monero, a privacy coin, and bridged assets across multiple chains.

On Tuesday, ZachXBT named Crédit Mutuel Arkéa as the alleged victim. “Disclosing the EU financial institution exploited for $133M+ is allegedly Credit Mutuel Arkea, a French bank with $235B in assets,” he wrote on his Telegram channel. He said the attack on the bank had taken place over multiple days and added that he suspected the amount stolen was larger when over-the-counter activity was included. These details are claims made by the investigator; the bank did not independently confirm them in its statement.

In a further update on Tuesday, ZachXBT said he had identified another $27 million in exchange withdrawals by the attacker. He said this brought the total to more than $133 million and noted that some withdrawals occurred after his initial disclosure. He also published four Ethereum addresses that he said were linked to the theft. The addresses and transaction analysis form part of his public account, but the bank has not confirmed the attribution or the values.

ZachXBT said his working theory was that a large financial institution in Western Europe had been exploited and that the incident was being covered up. He accused the institution of not conducting “proper incident disclosure,” which he argued had prevented law enforcement from freezing some $30 million in stolen funds. He did not explain publicly how he identified the bank, or how the attacker obtained access to the exchange accounts in question. As a result, both the route of access and the relationship between the exchange accounts and the bank remain unclear in the information provided.

The group has previously been preparing to enter the crypto market. In May, French financial newspaper L’Agefi reported that Crédit Mutuel Arkéa had applied for a license under MiCA, the European Union’s crypto rulebook. The reported plan was to offer crypto services to retail customers and provide them as a white-label service through its Arkéa Banking Services division. That background may explain why the alleged incident has attracted attention in the digital-asset sector, but it does not confirm that the reported theft involved the bank’s planned crypto services.

The allegations also emerged days after the $6.3 billion hack of Binance, described in the source account as the largest crypto theft on record. The FBI attributed that incident to North Korean hackers. ZachXBT said the attacker in the suspected European Union theft remained unidentified, but stated that, based on multiple laundering indicators, he could say “with a high degree of confidence it is NOT Lazarus Group,” the North Korean hacking collective. This is his assessment, not a confirmed identification of the attacker.

The distinction between the confirmed cyberattack and the alleged crypto theft is important for interpreting the available information. Crédit Mutuel Arkéa confirmed fraudulent operations, said it had taken precautions, and reported that customer assets were unaffected. It did not provide a loss total or verify cryptocurrency involvement. ZachXBT, meanwhile, described exchange withdrawals, token swaps, cross-chain movements, and an estimated total above $133 million. Until the bank or relevant authorities provide additional confirmation, the scale, source, and destination of any losses should be treated as unresolved.

The bank’s statement also indicates that operational disruption was part of the incident response: some transfers were delayed, certain transactions were suspended temporarily, and operations were restarted gradually after security measures were strengthened. These measures were presented as steps to contain the incident and reduce the risk of further fraudulent activity. The bank’s warning about phishing highlights a separate risk that can follow public reports of a cyberattack, when customers may receive deceptive messages claiming to offer assistance or request account information.

Overall, the episode contains two parallel narratives. The bank has acknowledged a cyberattack and described its immediate response, while ZachXBT has connected the institution to a much larger alleged cryptocurrency theft. The bank’s confirmation gives the incident a clear institutional dimension, but the reported dollar amount and the crypto transaction trail have not been confirmed by the bank. Further details from the institution, investigators, or supervisory authorities would be needed to establish the full scope and financial impact.

Key Insights Table