Crédit Mutuel Arkéa, a French mutual banking group, confirmed on Wednesday 4 November 2026 that it had suffered a cyberattack that enabled fraudulent transactions. Blockchain investigator ZachXBT’s tracing suggests losses could exceed $133 million, part of which was converted into crypto assets. The bank has not confirmed any figure and says the incident is now under control.
🔑 Key takeaways
- Crédit Mutuel Arkéa acknowledges a cyberattack that enabled fraudulent transactions, without officially quantifying the losses.
- Investigator ZachXBT identifies more than $133 million in total, roughly €118 million at the rate cited by the media.
- About $62.98 million in stablecoins was reportedly swapped for Ether via UniswapX within four hours.
- Kraken and Crypto.com restricted linked accounts and funds, and both say their own security was not compromised.
A confirmed attack, with no official figure yet
The mutual group, based in Brittany and grouping the Crédit Mutuel de Bretagne and Sud-Ouest regional banks, acknowledged the incident in a public statement. It describes the fraudulent operations as now « under control », without specifying the intrusion method or the exact scope affected. Media dates differ: L’AGEFI places the incident on 1 November, while Les Échos describes an intrusion into the bank’s IT systems that unfolded over several days. The available sources do not define the exact time window.
Once the attack was detected, Arkéa mobilised its teams, alerted the competent authorities and supervisory bodies, and temporarily suspended certain transactions. The bank then announced reinforced security measures and a gradual resumption of some operations on the morning of 4 November. In its statement, it said:
“Once the attack was detected, our teams immediately mobilised and, as a precautionary measure, decided to temporarily suspend certain transactions in order to secure operations and prevent any further fraudulent movements.”
Crédit Mutuel Arkéa, statement of 4 November 2026
Sources do not fully agree on the state of services at the time of their reporting. Cryptoast said operations had begun resuming gradually, while Le Monde still reported that some banking services, including transfers, were inaccessible. Some transfers were in any case delayed.
The bank says the incident had “no financial consequence” for its customers, and Cryptoast reports that client assets were not affected. Arkéa says it is continuing its investigations to precisely assess the losses, whose amount remains unconfirmed, and that the losses do not call its financial strength into question. No provision, detailed balance sheet or final allocation of responsibility has been published so far.
Blockchain tracing: an estimate above $133 million
On Monday 2 November, ZachXBT announced on his Telegram group that an entity in the European Union was suspected of losing $106 million. The following day, he identified additional withdrawals of more than $27 million. On the night of Tuesday to Wednesday, he named the French bank. The combined total therefore exceeds $133 million, or about €118 million at the rate cited by the media. The table below summarises the available figures.
| Step | Amount | Source |
|---|---|---|
| Initial report (2 November) | $106M | ZachXBT, Telegram |
| Additional withdrawals (3 November) | more than $27M | ZachXBT |
| Total identified | more than $133M (≈ €118M) | Media estimate |
| Stablecoins swapped within four hours | $62.98M | Bitquery |
| Ether received in exchange | 27,553 ETH | Bitquery |
According to Les Échos, citing The Block, ZachXBT identified Crédit Mutuel Arkéa as the presumed victim. The daily also reports, based on an unnamed source, that losses could exceed $100 million. L’AGEFI, for its part, cites a first assessment of several tens of millions of euros, although that assessment is not clearly attributed in the text reviewed. These figures remain estimates drawn from blockchain investigations, not losses officially acknowledged by the bank.
ZachXBT believes actual losses could be higher than the $133 million identified, notably because of over-the-counter (OTC) trades that would not appear in the initial tracing. Grégory Raymond also reports, citing anonymous sources, other diversion channels that do not involve cryptocurrencies. The full extent of the funds and their current whereabouts are not established by the available sources.
A suspected mechanism: transfers in the beneficiaries’ names
According to journalist Grégory Raymond, the fraudsters allegedly managed to issue transfers from Fortuneo, the group’s online bank, selecting the beneficiary name themselves. The funds were then allegedly sent to crypto trading platform accounts opened under fake identities, credible enough to pass verification procedures. The transfers were reportedly made in the exact names of the account holders to bypass identity matching controls. The accounts would therefore not be hijacked customer accounts at Fortuneo, but accounts created directly by the fraudsters.
“The equivalent of $133 million reportedly left the bank through hackers, then was routed to multiple accounts opened on crypto trading platforms.”
Grégory Raymond, journalist
The sources do not specify whether Fortuneo had applied this type of control, nor whether the mechanism was exploited technically or through human manipulation. The initial point of entry remains unknown. A source interviewed by the journalist put forward two hypotheses, neither of which has been established:
- a hack of Fortuneo’s payment systems;
- human manipulation resembling a CEO fraud, in which an executive’s identity is impersonated to persuade an employee to make fraudulent transfers.
Conversion into crypto assets and platform responses
According to blockchain analytics firm Bitquery, $62.98 million in stablecoins was swapped for 27,553 ETH within four hours, via UniswapX, Uniswap’s decentralised exchange service. The funds were then reportedly dispersed across several blockchain networks and instant exchange services, including WellWallet and Kyrrex. Part of the funds was reportedly converted into Monero, a cryptocurrency designed to obscure transactions, which significantly complicates tracking and any potential recovery.
Several platforms reacted to the identification of funds linked to the incident. Kraken restricted accounts it believed were tied to the operations, and Crypto.com blocked associated funds. Both companies say their own security was not compromised. The sources document no price movement in any financial or crypto asset directly linked to the announcement: the only market reactions identified are operational.
ZachXBT said he was “highly confident” that the perpetrators are not linked to the North Korean group Lazarus. He also criticised the bank for delaying its alert, arguing that more than $30 million could have been frozen had European authorities been warned quickly. Arkéa did not challenge this assessment in the published material. Finally, the bank urged customers to remain vigilant against possible phishing attempts exploiting the attack.
Outlook: a case that questions identity controls
Beyond the headline figure, the case raises a central question: the reliability of transfer matching controls and of account opening procedures at crypto trading platforms. When an intrusion combines with exchange accounts opened under false identities, the verification chain becomes the critical link, far more than technical cybersecurity alone.
Several scenarios remain open. In a central scenario, the losses would be confirmed between $100 million and $133 million, with provisions disclosed in the accounts. In a more favourable scenario, the freezing of funds by platforms and authorities would reduce the net loss. In an adverse scenario, additional OTC losses would push the total beyond $133 million, reigniting the debate over reporting delays. The bank’s and supervisory authorities’ next communications will be decisive.
For now, the final amount, the allocation of responsibility and the fate of the funds remain unknown. Investors and compliance professionals would be well advised to follow official confirmations rather than estimates based solely on on-chain tracing.
Conclusion
The attack on Arkéa illustrates the convergence of banking cybercrime and crypto conversion channels. Until the bank publishes validated figures, the $133 million total remains an estimate, but it is the reference point for any serious analysis of the case.
Sources
- Cryptoast: Crédit Mutuel Arkéa hack, crypto and 133 million ZachXBT
- Crédit Mutuel, official website
- L’AGEFI: Crédit Mutuel Arkéa admits cyberattack victim status
- RTL: 118 million euros diverted
- Les Échos: Crédit Mutuel Arkéa victim of hack exceeding $100 million
- Le Monde: Crédit Mutuel Arkéa confirms cyberattack
Cet article est publié à titre informatif et éducatif. Il ne constitue en aucun cas un conseil en investissement. Faites vos propres recherches (DYOR) avant toute décision.
