Crédit Mutuel Arkéa Hack: French Bank Confirms Cyberattack
Crédit Mutuel Arkéa confirms a cyberattack enabled fraudulent transfers, while ZachXBT links it to a $133 million crypto theft. Here is what is confirmed and what is not.
French bank Crédit Mutuel Arkéa confirmed on November 4 that a cyberattack let hackers make fraudulent transfers from its own account. On-chain investigator ZachXBT says the Crédit Mutuel Arkéa hack cost the bank more than $133 million, a figure the bank has not confirmed.
What the bank has confirmed
The Brittany-based lender says the incident is under control and that customer assets were not affected. It suspended some transactions as a precaution, informed its supervisors and is working with judicial and police authorities to establish the origin of the attack.
In a follow-up note, the bank said the attackers got in through the platform of one of its service providers and then reached the bank directly. They used the bank’s own account to send payments to other banks, which may have let them convert the money into crypto through specialized platforms. It rejected French press reports that the breach began at its online arm Fortuneo, calling the attack sophisticated and external rather than the result of human error.
How big is the loss?
The bank has not published a final number. Asked about a figure of about 118 million euros ($133 million), it said it could only validate the order of magnitude. AFP reported a provisional estimate of around 100 million euros, and a spokesperson told Reuters it is still too early for a final figure. The bank says part of the money has been frozen and that the amount is nowhere near large enough to threaten its financial health.
What ZachXBT found
ZachXBT first flagged the case on November 2 without naming a victim, describing a suspected European institution that lost more than $106 million from several centralized exchange accounts. The funds left as USDC and USDT and were swapped for ether, then moved through instant exchanges and bridged across chains. Some of it was converted into the privacy coin Monero, he said.
A day later he found at least $27 million more, lifting his estimate above $133 million, and then named Crédit Mutuel Arkéa. He believes the real total is higher once over-the-counter trades are counted. He also criticized the lack of early disclosure, arguing that more than $30 million was laundered before European law enforcement could freeze it. Crypto.com has since said it blocked funds linked to the theft, according to CoinDesk.
Where the two accounts differ
The bank describes transfers to other banks that were later turned into crypto. ZachXBT describes withdrawals from exchange accounts. The two versions may describe different stages of the same operation, but neither side has explained how they connect, and the bank has not named any exchange. It has also not said when the attack began, who was behind it or whether any data was taken. ZachXBT said he was highly confident the attack was not the work of North Korea’s Lazarus Group.
Why it matters for Europe
Arkéa serves about 5.8 million clients and manages roughly 211.5 billion euros in assets, according to Reuters. A theft of this size at a regulated European bank shows that attackers now treat bank payment systems and crypto rails as one route. The speed at which the money moved also raises a practical question for European regulators and banks: how fast must an incident be disclosed for frozen funds to be recovered?
The case comes days after the record Binance breach, which we covered in our reports on CZ’s warning that banks are in a worse position and on Binance replenishing 98% of affected assets.
What to watch next
Three things will settle the story: the bank’s final loss figure, how much of the stolen money is recovered, and whether authorities say how the service provider was compromised. Arkéa has also warned customers to expect phishing attempts that exploit the news.
