Crédit Mutuel Arkéa confirmed a cyberattack on Wednesday, November 4, after onchain investigator ZachXBT traced more than $133 million in suspected theft through crypto exchange withdrawals. The withdrawals began on November 1, days before he named the French bank as the suspected victim.
The bank says attackers transferred money from its own account. Some customer transfers were delayed during its response, but Arkéa says customer assets were untouched.
The provider access led to the bank’s account
Arkéa’s question-and-answer note describes the route into the bank. Attackers used a service provider’s platform to reach Arkéa directly, then sent money from the bank’s account to other financial institutions. Arkéa said that route could allow the money to be converted into cryptocurrency through specialized platforms.
The bank identified neither customer accounts nor Fortuneo, its online banking arm, as the entry point. It described the attack as an external operation rather than a human error. For customers, the immediate effect was a delay in executing some transfers, according to Arkéa’s statement.
Arkéa temporarily suspended some transactions to stop further fraudulent movements. After security checks and added safeguards, it resumed nearly all operations on Wednesday. The bank said it informed supervisory authorities after detecting the attack and is working with judicial and police authorities to establish its origin.
The $133 million figure comes from exchange withdrawals
ZachXBT started with withdrawals from centralized exchange accounts before identifying Arkéa. His posts set out when he found each group of withdrawals and how the suspected total passed $133 million.
- November 1: Withdrawals from exchange accounts were made in USDC and USDT, according to ZachXBT.
- Monday: His first post flagged more than $106 million in suspected withdrawals from an unnamed EU entity.
- Tuesday: He identified at least $27 million more, taking his total above $133 million.
- Wednesday: He named Arkéa as the suspected victim, and the bank confirmed the cyberattack.
ZachXBT said the attacker swapped USDC for ETH and moved funds through instant exchanges. The attacker then converted some funds into Monero and bridged assets across multiple chains. Blockchain analytics firm Bitquery traced withdrawals from accounts at Kraken, Crypto.com and OKX.
Those transactions show the path ZachXBT followed after the funds reached exchanges. Arkéa’s account describes the earlier access through the service provider and the transfers to financial institutions. Together, the accounts cover different stages of the same suspected theft.
The attack on the bank occurred for multiple days. I suspect the amount stolen is larger when accounting for OTC activity.
ZachXBT, onchain investigator
Arkéa said it could validate the approximate scale of the suspected theft. It has not confirmed ZachXBT’s exact figure, named the attacker or given a final loss figure.
The bank said part of the funds had been frozen and that recovery efforts were underway. Kraken and Crypto.com said they had restricted accounts or blocked funds linked to the suspected theft. Both said their platforms remained secure.
Customers keep their assets, but the bank bears the recovery fight
Arkéa says the amounts involved do not threaten its financial health. Because the fraudulent transfers came from its account, the bank faces the direct financial loss and must pursue recovery of the frozen funds. Customers instead faced delays while some transactions were suspended and checked.
The bank warned customers to watch for phishing attempts after the attack. A message claiming to resolve a delayed transfer could use the disruption to draw a customer into a scam, even though Arkéa says customer assets were unaffected.
