Crédit Mutuel Arkéa confirmed that a cyberattack enabled fraudulent transfers from the French bank’s own account, with the funds subsequently converted into cryptocurrency through specialized platforms. The bank said customer assets were unaffected, although some transfers were delayed.
The Block reported the confirmation on Nov. 5, 2026, at 12:00:14 UTC+8, following a bank statement released Wednesday. Onchain investigator ZachXBT, who first publicly flagged the exploit on Nov. 2, estimated losses at more than $133 million. The bank did not confirm an exact loss figure, but validated the order of magnitude.
Bank funds affected; some stolen funds blocked
Crédit Mutuel Arkéa said it had contained the incident and activated security measures upon identifying the attack to prevent further fraudulent movements against the bank.
“We wish to reassure all of our customers: this incident has had no impact on their assets,” the bank said. “It only caused a delay in the execution of certain transfers.”
The bank also said some stolen funds had been blocked. It cautioned that it was too early to provide a final amount, while stating that the sums involved would not undermine its financial strength or soundness. That assurance was the bank’s assessment, not a confirmed final accounting of the losses.
ZachXBT described a multichain conversion trail
According to ZachXBT, the attacker moved funds through transactions that included:
- Swapping USDC for ETH.
- Routing assets through instant exchanges such as WellWallet and Kyrrex.
- Converting funds into XMR through Wagyu.
- Bridging assets across multiple chains.
ZachXBT said the loss estimate could rise because the attack unfolded over several days and may have involved additional over-the-counter transactions. He also expressed a “high degree of confidence” that the attacker was not associated with North Korea’s Lazarus Group.
The reported crypto-routing activity and the bank’s account of customer exposure address different parts of the incident: ZachXBT described movements of stolen funds, while the bank said the fraudulent transfers originated from its own account and did not affect customer assets. The final loss remained unconfirmed.
According to its statement, Crédit Mutuel Arkéa had more than 12,000 employees, over 5.8 million members and customers, and reported total assets of €211.5 billion ($238.1 billion).