French banking group Crédit Mutuel Arkéa has confirmed a cyberattack in which fraudulent transfers moved funds out of the institution's own account and into cryptocurrencies via specialized platforms. The total scale is likely to exceed USD 133 million.

Crédit Mutuel Arkéa is one of France's major banks, employing more than 12,000 people and serving more than 5.8 million members and customers. The group's total assets stand at EUR 211.5 billion (USD 238.1 billion), and it owns the online subsidiary Fortuneo.

Notably, the case was not made public by the bank. The independent on-chain investigator ZachXBT exposed the theft in early November 2026, reconstructing the trail of the stolen funds across public blockchains. Arkéa confirmed the attack only two days later, stating that it had contained the incident and that customer assets were not affected. ZachXBT, meanwhile, cautioned that his USD 133 million estimate could still rise, because the attack stretched over several days and may have involved further over-the-counter (OTC) transactions.

Arkéa Confirms the Attack, Not the Amount

According to the bank, the attack enabled fraudulent transfers from the institution's own account, and the funds eventually moved into crypto through specialized platforms. The sequence stands out because the on-chain trail was public before the bank issued its statement. For two days, therefore, anyone with access to blockchain data could trace the outflow.

Arkéa endorsed ZachXBT's USD 133 million figure only as an order of magnitude. The bank added that the volume of fraudulent transactions need not match the final loss. A portion of the stolen funds remains blocked, but the institution says it is too early for a definitive figure and has not disclosed how large the blocked share is. In effect, Arkéa leaves open whether the ultimate damage will fall below or above the investigator's estimate.

Customers felt the incident only as delays to individual transfers, according to the bank. It had previously suspended certain transactions as a precaution, and by the morning of the confirmation almost all operations were running again. Arkéa stresses that its teams activated the necessary security measures immediately after discovery in order to prevent further fraudulent movements.

Measured against the group's total assets, the sum involved is comparatively small: USD 133 million equals roughly 0.06% of USD 238.1 billion. "We can already state that the amounts involved are in no way capable of undermining the financial strength and solidity of Crédit Mutuel Arkéa," the bank said.

How the Funds Exited Through Instant Exchanges and Monero

ZachXBT traced the path of the funds on-chain. First, an unidentified European entity withdrew more than USD 106 million from centralized exchanges. Around USD 27 million more followed later, according to ZachXBT. The total of more than USD 133 million therefore comes from two waves, with the second considerably smaller than the first.

The attacker then swapped the funds out of USDC and into ETH, among other conversions. Next, the money ran through instant exchanges such as WellWallet and Kyrrex and moved into Monero (XMR) via Wagyu. In addition, the attacker used bridges to spread parts of the proceeds across several chains. Each of these steps makes tracing harder. Instant exchanges typically handle individual swaps between two cryptocurrencies directly, while the switch into Monero weighs heaviest, because the privacy coin hides the addresses and amounts that remain openly visible on Ethereum.

Part of the funds was nearly out of reach early on. In the investigator's assessment, more than USD 30 million already sat beyond simple freezing routes, which he attributes to a late report to the authorities. USDC's issuer, for example, can block addresses and thereby freeze balances, whereas Ether has no such gatekeeper. Consequently, the final damage also depends on how much of the funds the bank actually managed to block.

Attribution draws attention in thefts of this size because North Korea's Lazarus Group has figured in a series of major cryptocurrency thefts documented in government and United Nations assessments. ZachXBT has also commented on who is behind the attack. He said he has "high confidence" that the attacker does not belong to North Korea's Lazarus Group. Neither the bank nor the investigator has named a perpetrator so far.

Bitquery Measures More Narrowly Than ZachXBT

The loss figures in circulation come from two measurements, and adding them together would be wrong. The highest comes from ZachXBT, who cites more than USD 133 million and considers a higher figure possible with further OTC transactions. In such deals, two parties negotiate bilaterally, often through specialized intermediaries and outside public order books, so they do not necessarily appear in exchange data. The EUR 118 million cited in some reports equals the same USD 133 million after currency conversion and is not a separate measurement.

The data provider Bitquery instead counts USD 108.8 million in USDC withdrawals from wallets it attributes to Kraken, Crypto.com and OKX. The funds went to 15 addresses within a measurement window of roughly 21 hours between November 1 and November 2, 2026. Excluding two addresses that are only indirectly linked leaves USD 95.7 million. The scope of each count therefore explains part of the gap, since ZachXBT captures both outflow waves while Bitquery's window is narrower.

On the day of the confirmation, Bitquery still saw around USD 42.6 million in linked Ethereum wallets, held mostly in ETH. That portion is at least visible on-chain. However, the measurement has a blind spot: Bitquery does not see bank transfers, so it cannot independently document the route from the bank's account into crypto. The link between Arkéa and the wallets therefore rests on ZachXBT's reconstruction as well as the bank's statement that funds flowed into crypto. The institution has not confirmed any of these figures as an exact amount.

Service Provider Platform Suspected as Entry Point

The bank offers only a brief account of the entry point. By its account, the attackers got into the system through a service provider's platform and sent money to other banks. An entry point of this kind places the case among third-party or supply-chain compromises, in which attackers reach an institution by targeting an external platform inside its operational chain. Arkéa has not confirmed whether this route also enabled the conversion into crypto, and on-chain data cannot capture precisely this step. The bank denied any access through its online subsidiary Fortuneo, and says the attackers did not use customer accounts. Officially, then, the exact method remains unexplained.

The setup of the case is unusual. The victim is the bank itself rather than individual customers or a crypto exchange, yet the money left through crypto channels. When the victim is the institution's own treasury rather than customer balances, the relevant security questions center on treasury controls and the oversight of external platforms. To clarify the origin and method of the attack, Arkéa is working with judicial and police authorities. The bank has also warned of possible phishing attempts. Beyond the method, both the final loss and the size of the blocked share of funds remain open.