Crédit Mutuel Arkéa Confirms Cyberattack After $133M On-Chain Alert

French banking group Crédit Mutuel Arkéa has confirmed a cyberattack that enabled fraudulent transfers from its own account, which were subsequently converted into cryptocurrency through specialized platforms. The bank validated the order of magnitude of the more than $133 million in suspected losses first flagged by on-chain investigator ZachXBT on Nov. 2, but declined to confirm an exact figure.

In a statement released Wednesday, the bank said client assets were unaffected and the incident had been contained. It acknowledged that some of the stolen funds had been blocked, though a final accounting remains open.

"As soon as this attack was identified, our teams immediately activated the necessary security measures to contain the incident and prevent any further fraudulent movement against Crédit Mutuel Arkéa," the bank said. The claim of full containment deserves scrutiny: ZachXBT noted the losses could still rise, because the attack unfolded over several days and may have involved additional over-the-counter transactions.

"We wish to reassure all of our customers: this incident has had no impact on their assets," the bank added. "It only caused a delay in the execution of certain transfers." A delayed transfer is an operational failure, not a trivial one, and the bank did not specify how many clients or payments were affected.

What did ZachXBT actually trace?

The investigator documented a laundering chain rather than a single breach. According to his findings, the attacker:

• Swapped USDC for ETH
• Routed assets through instant exchanges including WellWallet and Kyrrex
• Converted funds into XMR (Monero) via a service called Wagyu
• Bridged assets across multiple blockchains

That mix of stablecoin swaps, instant-exchange hops, a privacy-coin conversion and cross-chain bridging is a deliberate obfuscation pattern. Each step adds friction for investigators and for any attempted recovery of funds. ZachXBT also said he has a "high degree of confidence" that the attacker was not associated with North Korea's Lazarus Group — a notable caveat, since state-linked actors are the default suspicion in thefts of this size, but confidence is not proof, and no attribution was offered as an alternative.

How exposed is the bank?

The bank did not confirm the exact loss amount, but it did commit to a framing on solvency. "While it is therefore still too early to communicate a final amount, we can already state that the amounts involved are in no way of a nature to undermine the financial strength and soundness of Crédit Mutuel Arkéa," the bank said.

The arithmetic supports that claim, at least on paper. The suspected loss of roughly $133 million equals about 0.06 percent of the bank's reported total assets of €211.5 billion ($238.1 billion) — roughly one euro lost for every 1,800 euros on the balance sheet. Spread across the bank's more than 5.8 million members and customers, the figure amounts to approximately $23 per account holder. For an institution with over 12,000 employees, this is a reputational and operational event more than a solvency event.

What the statement does not address is the mechanism: how fraudulent transfers left the bank's own account, whether internal controls or a third-party provider failed, and whether any counterparties in the conversion chain bear responsibility. Those gaps will matter to regulators and to corporate clients assessing payment reliability.

What happens next?

The confirmed blocking of some stolen funds suggests recovery efforts are under way, likely in coordination with crypto platforms along the laundering route. Monero conversions, however, are effectively terminal for traceability, and the bank has signaled that a final loss figure will come only after the review concludes. Expect the number to move, and expect French financial authorities to press for a fuller explanation of how the bank's own account was compromised.