French bank Crédit Mutuel Arkéa hit in cyberattack — up to $133 million stolen and systems shut down

• Crédit Mutuel Arkéa confirms cyberattack led to the theft of roughly $133 million from the bank itself
• Attackers reportedly converted stolen funds into cryptocurrency and laundered them across multiple services and blockchains
• Bank says customer assets were unaffected, while investigators continue probing the third-party compromise

Crédit Mutuel Arkéa, a major French banking and financial services group, has confirmed it recently suffered a cyberattack that resulted in the theft of around $133 million.

The stolen money apparently did not belong to customers, but rather to the bank itself, and was converted into cryptocurrency to be siphoned out more easily.

The attack was first spotted by ZachXBT, a cryptocurrency analyst and blockchain fraud investigator who issued an alert on November 2 2026. “An EU entity is suspected of losing $106M+ from multiple centralized exchange accounts yesterday (Nov 1),” he said at the time. “The suspected stolen funds were withdrawn as USDC & USDT by an illicit actor.”

Blockchain as the tech of choice for both sides

It appears the attackers converted fiat currency into different cryptos before sending them out. As ZachXBT explained, the threat actor was “aggressively swapping” USDC (a stablecoin currency, one whose value is pegged to that of the US dollar) for ETH (Ethereum) and transferring the tokens to instant exchanges such as WellWallet and Keyrex. Some of the funds were converted to XMR (Monero, a known privacy-first token whose transactions are notoriously difficult to track) via Wagyu, and later bridged “across multiple chains.”

The irony is pbvious - blockchain and cryptocurrencies are often perceived as the go-to platforms for financial fraud and while many defend it by saying the fraud conducted via fiat is magnitudes larger, the fact remains the crooks transferred dollars to cryptos during theft.

On the other hand, the attack was not even discovered (at least publicly) until it hit the public blockchain where analysts like ZachXBT were able to see it and report on it.

A day later, ZachXBT issued an update, saying he identified an additional $27M+ of withdrawals, bringing the total amount stolen to $133M+.

“My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up,” he said. “No proper incident disclosure has resulted in $30M+ being laundered away which could have been frozen by EU law enforcement,” he added, suggesting that Crédit Mutuel Arkéa handled the situation poorly.

In his reports, however, he never mentions the name of the organization targeted. Crédit Mutuel Arkéa released a brief statement on November 4, saying it suffered an attack which it later managed to contain.

“As soon as this attack was detected [...] the decision was made, as a precautionary measure, to temporarily suspend certain transactions in order to secure operations and prevent any further fraudulent movements,” the announcement reads.

“This incident is closed and is now under control. Operations are being gradually resumed over the course of the morning, after the group and its subsidiaries ensured that checks had been carried out and enhanced security measures had been put in place.”

Not Lazarus

In an FAQ published a day later, the company said the attackers “went through the platform of one of our service providers and thus reached Crédit Mutuel Arkéa directly.” It did not want to say which service provider that is, but ruled out Fortuneo since that name was apparently being mentioned in local press.

The attackers used Arkéa's own account to carry out transactions with other banking players, it said, confirming that customer funds are safe and unaffected.

“We would like to reassure all our customers that this incident has no consequences for their assets. It only led to a delayed execution of certain transfer operations,” the FAQ further states.

The bank did not want to confirm the amount of money that was stolen, but commenting on ZachXBT’s $133 million figure, said it can “simply validate the order of magnitude.” In other words - it’s a close estimate.

So far no threat actors claimed responsibility for this attack, and chances are none will. ZachXBT believes this was not the work of notorious North Korean actors Lazarus Group.

Via BleepingComputer