Crédit Mutuel Arkéa: French Bank Confirms Cyberattack as ZachXBT Says $133M Left Through Crypto

At 12:25 UTC on Sunday 1 November 2026, a payment in digital dollars left OKX, a crypto exchange. Forty-four minutes later another left Kraken. By Monday morning $108.8 million had gone out of OKX, Kraken and Crypto.com to 15 wallets, according to the blockchain analytics firm Bitquery. An exchange is crypto's version of a broker, and on a quiet Sunday somebody was moving a fortune out of three of them.

In the early hours of Wednesday, Paris time, the investigator ZachXBT said whose money he believed it was. It was not a crypto company's. It was a bank's.

Crédit Mutuel Arkéa is a French cooperative banking group based near Brest, with 12,073 staff, more than 5.8 million members and customers and a balance sheet of €211.5 billion. It brings together the Crédit Mutuel federations of Brittany and the South-West and owns Fortuneo, an online bank. On 4 November it announced that an attack had allowed "fraudulent operations". It has confirmed the attack and the transfers. It has not confirmed the crypto. Its own wording is that the money went to other banks, which then "potentially" let the attackers convert it into cryptocurrency on specialised platforms. The crypto getaway is ZachXBT's account, and nobody has publicly proved the link between the bank's transfers and those wallets.

Three numbers, three owners

ZachXBT, a pseudonymous investigator who follows stolen money on public blockchains, spoke first. On 2 November he said an unnamed European Union entity had lost more than $106 million from accounts at several exchanges. On 3 November he found a further $27 million in withdrawals and raised his estimate to more than $133 million. "I suspect the amount stolen is larger when accounting for OTC activity," he wrote. OTC means over the counter: private deals away from public markets, like a block trade between two desks.

Le Télégramme, the Brittany daily, put that at €118 million. Asked directly, the bank answered: "We do not confirm this information and can only validate the order of magnitude." It said a final amount would be premature because part of the money had been blocked and more recovery work was under way. AFP reported that evening that the bank gave a provisional estimate of about €100 million, a figure that does not appear in the two statements on the bank's website. The bank says the sums do not threaten its financial health.

Bitquery's $108.8 million is a third figure with a narrower scope: USDC paid by those three exchanges to 15 addresses. It could not confirm $133 million on Ethereum. It says it cannot see bank transfers or exchange accounts, so it cannot prove how the money was taken. Without two loosely linked wallets its count falls to $95.71 million. The figures overlap and should not be added together.

How a bank transfer could become a getaway car

The bank's part of the story is short. The attackers used its "own account", the group's money rather than a customer's, to send transactions to other banks. Everything after that comes from the trackers.

ZachXBT says the money came out of exchange accounts as USDC and USDT. These are stablecoins, digital dollars issued by the companies Circle and Tether. For a thief they have one flaw: the issuer can freeze them at any address, much as a bank can block an account.

So the next step, Bitquery found, was to swap them. Between 23:44 UTC on Sunday and 04:02 UTC on Monday a fresh wallet sold $62.98 million of USDC and USDT through UniswapX, an auction where trading firms compete to fill orders. It received 27,553 ETH, the coin of the Ethereum network, which no company can freeze. Another branch went into DAI, a stablecoin with no freeze button.

ZachXBT described what followed: the actor was "aggressively swapping USDC for ETH", moving funds to instant exchanges (services that swap one coin for another in minutes), naming WellWallet and Kyrrex, and converting to Monero through a service called Wagyu. Monero is a privacy coin, built so that its transfers cannot be followed on a public ledger. Other funds crossed bridges, which carry value from one blockchain to another. Bitquery names one, LI.FI, as the biggest single route out, at $22.26 million.

One detail suggests planning, if the wallets belong to the same operation. Bitquery says 11 of the 15 wallets had taken payouts from the same exchanges before the theft, two of them since May.

Which door they used

The first explanation pointed at Fortuneo. Grégory Raymond, a French crypto journalist who writes the 21 millions newsletter, reported that fraudsters had sent transfers from the online bank to exchange accounts opened under false identities, good enough to pass identity checks. One of his unnamed sources thought a person, not a technical flaw, was the weak point.

The bank rejects both ideas. "No," its statement says when asked about Fortuneo: no entry was made there. The attackers came "through the platform of one of our service providers" and reached the group directly. Asked about human error at Arkéa, it again said no, calling this "a sophisticated attack from outside". It has not named the provider or said how that platform was used. Customer accounts at its federations and subsidiaries were not used, it says, and customers' holdings were not affected. Some transfers were delayed, almost all operations resumed on the morning of 4 November, and the bank called the incident "closed and now under control". It reported no theft of customer data, but warned that phishing attempts could follow.

Was the bank too slow?

ZachXBT says yes. On 3 November, before naming anyone, he wrote: "My working theory is a large financial institution in Western Europe was exploited and it's currently being covered up." He said the lack of "proper incident disclosure" had let more than $30 million be laundered that European authorities could have frozen.

The bank's answer is that its security systems spotted the suspicious activity "very quickly", that it told supervisors as soon as the attack was detected, and that it suspended some transactions as a precaution. It has not said when that was. The public record gives only the ends of the gap: the first withdrawal on Sunday, and a complaint reaching Paris prosecutors on Wednesday morning.

The freezes that are known were small. Bitquery says Tether froze 1.14 million USDT at 23:10 UTC on 2 November, and that Circle had frozen none of the 1.71 million USDC still held on 4 November. Bitquery adds that it does not know whether anyone asked Circle to act.

What the exchanges say

The bank has named no platform. The exchanges appear in this story through the blockchain trail. Crypto.com told CoinDesk it had acted to block funds linked to the incident and that user funds were secure. OKX told CoinDesk it had spotted unusual activity on an institutional customer's account and frozen that account. Kraken told Cointelegraph it had restricted accounts or blocked funds, and said its platform remained secure. Raymond, in a thread quoted by France 3, gave its position as no breach of its security and no customer account taken over by outsiders. Kraken did not answer CoinDesk.

As for who did it, nobody has claimed the attack, and no authority has named anyone. ZachXBT says only that the attacker is unidentified, but that he can state "with a high degree of confidence it is NOT Lazarus Group", the North Korean hacking unit, "based on multiple laundering indicators". In a reply on X the same day he went further, writing that the actor is "French-speaking and has a bit of onchain overlap with cybercrime forum users". That sets it apart from the $6.3 billion Binance hack days earlier, which the FBI attributed to North Korea.