French Bank Crédit Mutuel Arkéa Confirms Cyberattack as ZachXBT Traces $133 Million Through Crypto Exchanges

A week after the biggest exchange hack on record, crypto's latest heist did not start at a crypto company at all. It started inside a French bank.

Crédit Mutuel Arkéa, the Brittany-based banking group, has confirmed it was hit by what it calls a "sophisticated attack coming from the outside". On-chain investigator ZachXBT says the thieves pulled more than $133 million out through crypto exchange accounts, and the bank now says it can "validate the order of magnitude".

What happened

ZachXBT first flagged the theft on Monday, 2 November. According to Decrypt, he said an unnamed entity in the European Union may have lost more than $106 million from accounts at several crypto exchanges on 1 November.

The money left as USDC and USDT. The attacker then swapped USDC into ETH, moved funds through instant exchanges, converted part of it into the privacy coin Monero and bridged across several chains, Decrypt reported.

On Tuesday he raised the tally. He found another $27 million in exchange withdrawals, some made after his first post, taking the total above $133 million. On his Telegram channel he then named the alleged victim: "Credit Mutuel Arkea, a French bank with $235B in assets."

"The attack on the bank occurred for multiple days," he wrote, as quoted by Decrypt. "I suspect the amount stolen is larger when accounting for OTC activity." The Block noted that he said he was highly confident the attacker was not linked to North Korea's Lazarus Group.

What the bank says

Arkéa's account, published in a question-and-answer note on its website, describes a route that never touched customer accounts. The attackers went through "the platform of one of our service providers" and reached the group directly.

From there they used Crédit Mutuel Arkéa's own account to send transfers to other banks. Those transfers, the bank says, then potentially let them convert the money into cryptocurrency on specialised platforms.

The bank denied French press reports that the way in was Fortuneo, its online banking subsidiary. It also ruled out human error inside Arkéa, The Record from Recorded Future News reported.

Asked directly whether €118 million ($133 million) was stolen, Arkéa said it does not confirm the figure but can validate its scale. AFP reported the bank put the fraudulent transactions at around €100 million ($112 million).

Customers, the bank insists, lose nothing. "This incident has no financial consequences for [our clients]. Their interests are fully protected," a spokesperson told CoinDesk. Some transfers were delayed, and most operations resumed the next morning, according to the bank's note.

Where the money went

Blockchain analytics firm Bitquery traced $108.8 million in USDC withdrawn from accounts at Kraken, Crypto.com and OKX over 21 hours on 1 and 2 November, CoinDesk reported. Much of it was converted into ether, which no central issuer can freeze.

That detail matters. Stablecoins like USDC and USDT can be frozen by their issuers. Once the funds become ETH or Monero, the job of clawing them back gets much harder.

Exchanges did step in. "We are aware of this report and have taken action to block funds linked to the incident from moving through Crypto.com. All user funds remain secure and accessible," a Crypto.com spokesperson told CoinDesk, which added that OKX also confirmed it intervened.

Arkéa says part of the funds has been blocked and other recovery actions are under way. Bitquery, for its part, could not verify the full reported loss or identify the victim on its own, CoinDesk said.

Why it matters

This is a different kind of crypto hack. No smart contract was exploited and no exchange hot wallet was drained. A traditional bank was breached through a supplier, and crypto rails became the exit.

It lands at a raw moment for the industry. Binance is still dealing with the fallout of its $6.3 billion theft, which it says began with a fake job interview and an internal AI tool. Brazil's Mercado Bitcoin has its own breach to clean up.

That Brazilian case, where Mercado Bitcoin pledged to cover a $40 million hot-wallet loss, was a crypto firm defending crypto. Arkéa shows the threat now runs the other way too: thieves can rob a bank and cash out through exchanges in less than a day.

It also shows what on-chain transparency can do. A pseudonymous investigator spotted the outflows and named the bank before the bank spoke publicly, and exchanges froze part of the money in response.

Still, the speed cuts both ways. Bitquery's trace shows more than $100 million moved in under a day, long before anyone outside the bank knew a breach had happened. Exchanges can only freeze what they see in time.

What comes next

The Paris public prosecutor's office has opened an official investigation into an "attack on an automated data processing system by an organised group", AFP reported. Arkéa says it is working with judicial and police authorities to pin down the origin and method of the attack.

Key open questions remain. Which service provider was compromised? How much has been frozen? And how much slipped into Monero, where tracing gets far harder?

For context, Arkéa reported net profit of €230 million in the first half of the year, according to AFP, and the bank says the losses are "absolutely not of a nature" to threaten its financial health.

Markets, meanwhile, have been focused elsewhere. Bitcoin held above $80,000 on Thursday in a post-election rebound led by Zcash, as we covered in this morning's Zcash report. For banks plugging into crypto rails, the lesson is less comfortable: the weakest link may be a supplier, and the exit may be a stablecoin.