Crédit Mutuel Arkéa Confirms Cyberattack After $133M Crypto Theft Allegation

Crédit Mutuel Arkéa has confirmed a cyberattack that enabled fraudulent operations, one day after on-chain investigator ZachXBT named the French banking group as the alleged victim of a crypto theft exceeding $133 million. The bank disclosed the breach in a statement shared with Decrypt on Wednesday.

The mutual banking group said the incident is "closed and now under control." Operations are resuming gradually after it deployed stronger security measures. It told customers their assets were not affected, and that the attack only delayed execution of some transfers.

The bank never mentioned crypto. It never confirmed a figure either. The amounts affected are still being assessed, the bank said, but are "in any event not of a nature to call into question the solidity and financial health of the group," according to Decrypt's translation.

Crédit Mutuel Arkéa said it informed the relevant supervisory authorities as soon as it detected the attack, and temporarily suspended some transactions as a precaution to block further fraudulent movements. It also warned customers to watch for phishing attempts following the breach. Decrypt has approached the bank for further comment, including on whether the losses involved crypto at all.

What did ZachXBT actually allege?

"Disclosing the EU financial institution exploited for $133M+ is allegedly Credit Mutuel Arkea, a French bank with $235B in assets," ZachXBT wrote on his Telegram channel on Tuesday. "The attack on the bank occurred for multiple days. I suspect the amount stolen is larger when accounting for OTC activity."

The timeline matters here. On Monday, he first flagged a suspected theft of more than $106 million from an unnamed EU entity's accounts at several crypto exchanges on November 1. The funds left as USDC and USDT, he said, and the attacker then swapped USDC for ETH, pushed funds through instant exchanges, converted some into privacy coin Monero, and bridged across multiple chains.

On Tuesday, he identified a further $27 million in exchange withdrawals, lifting the total past $133 million. Some of those withdrawals occurred after his initial disclosure. He also published four Ethereum addresses he tied to the theft.

"My working theory is a large financial institution in Western Europe was exploited and it's currently being covered up," ZachXBT wrote. He accused the institution of failing to conduct "proper incident disclosure," which he said prevented law enforcement from freezing some $30 million in stolen funds. He did not explain how he identified the bank, or how the attacker gained access to its exchange accounts.

Why the timing is awkward for the bank

What does this change for a bank on the doorstep of regulated crypto? Plenty. In May, French financial newspaper L'Agefi reported that Crédit Mutuel Arkéa had applied for a license under MiCA, the EU's crypto rulebook, to offer crypto services to retail customers and provide them as a white-label offering through its Arkéa Banking Services division. A breach of this scale, disclosed only under external pressure, will not help that application.

The allegation also lands days after the $6.3 billion hack of Binance, the largest crypto theft on record, which the FBI attributed to North Korean hackers. ZachXBT said the attacker in the suspected EU theft remains unidentified, but that he could say "with a high degree of confidence it is NOT Lazarus Group," the North Korean hacking collective, "based on multiple laundering indicators."

The bank's supervised statement and the investigator's on-chain figures still leave a gap between them. With ZachXBT claiming the total runs higher once OTC activity is counted, and roughly $30 million left unfrozen because of delayed disclosure, the coming weeks will show whether French supervisors force a fuller accounting — and whether the bank's MiCA application survives the scrutiny intact.