Credit Mutuel Arkea Confirms Cyberattack as ZachXBT Tracks $133M in Transfers

French bank Credit Mutuel Arkea confirmed on Wednesday that hackers used its own account to carry out fraudulent transfers, in a theft that on-chain investigator ZachXBT estimates at more than $133 million and that the bank has declined to confirm.

The Brittany-based lender said in a formal statement that the incident is under control, operations are resuming, and customer assets were not affected. It suspended some transactions as a precaution. "This incident has had no impact on (customer) assets and has only caused a delay in the execution of certain transfers," the bank said on its website, in a translation published by Reuters.

The number is the hardest fact in a story full of soft ones. Asked whether 118 million euros, or $133 million, had been stolen, the bank said it does not confirm the figure and can only "validate the order of magnitude." AFP reported that the bank put the attack at roughly 100 million euros in a provisional estimate. A spokesperson told Reuters the losses were lower than $133 million. "It is still too early to give a final figure," the spokesperson said.

How did the attackers get in?

In a follow-up question-and-answer note, Credit Mutuel Arkea said the attackers entered through the platform of one of its service providers and reached the bank directly. They used the bank's own account to send transactions to other banks, which then potentially allowed them to convert the money into cryptocurrency through specialized platforms.

No customer accounts at its federations or subsidiaries were used, the bank said. It also denied French press reports that the attackers got in through Fortuneo, its online banking arm. The bank described the incident as "a sophisticated attack from the outside," not the result of human error.

The operational picture matters here. A compromise routed through a third-party provider and the bank's own treasury account is a different failure mode than a retail-facing breach. It points to gaps in vendor risk management and interbank transfer controls rather than weaknesses in consumer banking channels.

What does ZachXBT's on-chain trail show?

The investigator first flagged the incident on Monday without naming the victim. On his Telegram channel, he wrote that an EU entity was suspected of losing more than $106 million from multiple centralized exchange accounts on Nov. 1, with the funds withdrawn as USDC and USDT. He said the funds were then swapped for ether and moved across several chains.

In a subsequent update, he said he had identified another $27 million or more in exchange withdrawals, bringing the total above $133 million. A later post named Credit Mutuel Arkea as the alleged victim. He wrote that the attack "occurred for multiple days" and that he suspects the amount stolen is larger once over-the-counter activity is counted.

The bank has not confirmed his figure or his timeline. It has also not said when the attack began, who was behind it, or whether any data was taken. Credit Mutuel Arkea is working with judicial and police authorities to determine the origin of the attack and how it was carried out, and said it informed its supervisors once the attack was detected.

What does this change for the bank?

Credit Mutuel Arkea groups the Credit Mutuel federations of Brittany and the Southwest and is part of the wider Credit Mutuel group. It serves 5.8 million clients and holds 211.5 billion euros, or about $238 billion, in assets, according to Reuters. It posted net profit of 230 million euros in the first half of the year, AFP reported.

On those numbers, even the high-end estimate is survivable. The bank said the amounts at stake are "absolutely not" large enough to threaten its financial health or soundness. Part of the funds involved has been frozen, and the bank said other steps are underway to recover the rest.

Still, a nine-figure loss through the bank's own account invites supervisory scrutiny of its payment infrastructure, its service-provider oversight, and its detection timelines. The bank also warned customers that phishing attempts are possible following the incident.

A crowded week for crypto-linked breaches

The attack lands less than a week after the record $6.34 billion Binance hack, which blockchain analysis firms have linked to North Korea. Brazil's Mercado Bitcoin also froze deposits and withdrawals this week after a security incident.

ZachXBT drew one distinction: he said in his first post that he was highly confident this incident was not the work of North Korea's Lazarus Group.

How much of the money the bank can recover, and what the final loss will be, remains open.