Crédit Mutuel Arkéa Confirms Cyberattack Behind $133M Crypto Theft

By Nodora News · 4 November 2026

French bank Crédit Mutuel Arkéa confirms a cyberattack enabled fraudulent transactions after ZachXBT tied it to a $133M crypto theft moved through exchanges.

French banking group Crédit Mutuel Arkéa confirmed on Wednesday, November 4, that it was hit by a cyberattack that allowed "fraudulent transactions," hours after on-chain investigator ZachXBT named it as the suspected victim of a crypto theft he estimates at more than $133 million. Much of the stolen money left centralised exchange accounts as the USDC stablecoin and was quickly swapped into Ethereum (ETH), a coin no central issuer can freeze. The bank says the incident is now under control and that customers will not lose any money.

Key takeaways

• Crédit Mutuel Arkéa confirmed an attack that enabled fraudulent transactions, and says the incident is now contained.
• ZachXBT estimates losses above $133 million; French broadcaster franceinfo reports more than €100 million. The bank has not confirmed a figure.
• Blockchain analytics firm Bitquery traced $108.8 million in USDC withdrawn from Kraken, Crypto.com and OKX accounts over about 21 hours on November 1 and 2.
• Crypto.com says it has blocked funds linked to the incident. The bank says part of the money has been frozen.
• ZachXBT says he has a "high degree of confidence" that North Korea's Lazarus Group was not behind it.

What happened at Crédit Mutuel Arkéa

The story began on Monday, when ZachXBT warned that an unnamed European entity had lost more than $106 million from several exchange accounts. Nodora covered that first alert in Crypto Theft: $106M Stolen From EU Entity's Exchange Accounts. On Tuesday he found another $27 million in withdrawals, some made after his public warning, which pushed his tally past $133 million. Kraken then restricted accounts tied to the activity, as reported in Kraken Restricts Accounts as Suspected EU Crypto Theft Hits $133M.

On Wednesday, ZachXBT named Crédit Mutuel Arkéa as the victim. The Brittany-based cooperative group, which brings together the Crédit Mutuel de Bretagne and Crédit Mutuel du Sud-Ouest federations and owns the online bank Fortuneo, then confirmed the attack to CoinDesk and to French media. It did not say how much was taken, whether the funds started out as euros or as crypto, or how the attackers got in.

According to franceinfo, the money was converted into cryptocurrency to get it out of the bank. The bank's mobile app was also unavailable to customers for much of Wednesday.

The numbers so far

The figures come from different trackers and are not all measuring the same thing:

• $133 million+: ZachXBT's running estimate, which he says could rise once over-the-counter (OTC) trades are counted. OTC trades are private deals arranged off public exchanges.
• $108.8 million: USDC that Bitquery traced leaving accounts at Kraken, Crypto.com and OKX on November 1 and 2.
• About $63 million: stablecoins that Bitquery says were swapped into roughly 27,553 ETH within about four hours.
• "Several tens of millions of euros": the amount the bank told Le Parisien had been frozen, with the final figure still being assessed.

Why it matters for crypto and banks

This is unusual because the victim is a traditional bank rather than a crypto exchange or DeFi protocol. Crédit Mutuel Arkéa has also been preparing to offer crypto services: French outlet L'Agefi reported in May that it had applied for a licence under MiCA, the EU's crypto rulebook.

The case also shows how fast stolen stablecoins move. USDC and Tether's USDT can be frozen by their issuers, so attackers typically swap them into ETH within hours. ZachXBT criticised the lack of an early public disclosure, saying it allowed more than $30 million to be laundered that EU law enforcement might otherwise have frozen.

It lands in a rough stretch for crypto security, following the record $6.3 billion Binance breach and the hack of Brazil's Mercado Bitcoin, whose operator has vowed to cover all user losses. Unlike the Binance attack, which the FBI attributed to North Korea, ZachXBT says the way these funds moved does not match Lazarus Group patterns.

Market reaction

The news has not shaken the wider market, which was already recovering from an overnight dip tied to the US midterm results. As of about 9:45 PM AEDT on November 4, OKX prices showed:

• Bitcoin (BTC): about $78,540, up 2.0% in 24 hours
• Ethereum (ETH): about $2,328, up 2.6% in 24 hours

The roughly 27,500 ETH reportedly held by the attacker is small next to Ethereum's daily trading volume, so a sale would be unlikely to move the price much on its own. You can follow ETH live on the Nodora charts page.

What to watch next

• A confirmed loss figure. The bank says it is still assessing the damage and has notified the relevant authorities.
• More freezes. Kraken and OKX have not commented publicly on whether they froze funds.
• How the attackers got in. No explanation has been given yet.
• Customer services. The bank paused some transactions as a precaution and says they will resume quickly once security checks are complete.

This article is for information only and is not financial advice.

#Ethereum #Crédit Mutuel Arkéa #Crypto Hack #ZachXBT #Security

This article is general information, not financial advice.