Crédit Mutuel Arkéa has confirmed that a cyberattack enabled fraudulent operations at the French banking group, one day after on-chain investigator ZachXBT — a pseudonymous researcher known for publicly documenting large cryptocurrency thefts — identified it as the alleged victim of a crypto theft exceeding $133 million. The bank said the incident was under control and that customer assets were unaffected, but it did not disclose how much was taken or confirm cryptocurrency losses.

According to the group, operations are resuming gradually following the introduction of stronger security measures. Some transfers had been delayed, and the bank temporarily suspended certain transactions in order to prevent further fraudulent movements.

“Closed and Now Under Control”

In a statement shared with Decrypt on Wednesday, Crédit Mutuel Arkéa described the incident as “closed and now under control.” The bank said it notified the relevant supervisory authorities as soon as it detected the attack, and it warned customers to remain alert to phishing attempts following the incident, in which attackers impersonate trusted institutions to trick people into handing over credentials or funds.

The amounts involved were “in any event not of a nature to call into question the solidity and financial health of the group,” the bank added, according to Decrypt’s translation. The statement made no mention of cryptocurrency and gave no figure for the amount taken. Decrypt said it had asked the group whether the losses involved crypto.

The confirmation followed ZachXBT’s public identification of Crédit Mutuel Arkéa as the institution he believed had been targeted. In a Telegram post on Tuesday, he named the group and alleged a theft of more than $133 million, saying the attack spanned multiple days and that the total could be higher once over-the-counter activity is counted.

ZachXBT’s Account of the Withdrawals

ZachXBT first raised the suspected theft on Monday. He said an unnamed European Union entity may have lost more than $106 million from accounts at several crypto exchanges on November 1, with the funds withdrawn in USDC and USDT, two dollar-pegged stablecoins.

According to the investigator, the attacker then swapped USDC for ETH, moved funds through instant exchanges, converted a portion into Monero, a privacy-focused cryptocurrency that obscures transaction details, and bridged assets across multiple chains. He later said he had identified a further $27 million in exchange withdrawals, bringing the reported total to more than $133 million, with some withdrawals occurring after his initial disclosure.

ZachXBT also published four Ethereum addresses he said were linked to the theft. He did not explain how he identified the bank or how the attacker accessed the exchange accounts, and the bank’s statement neither confirmed those details nor connected the fraudulent operations to the alleged crypto movements.

The investigator further accused the institution of lacking “proper incident disclosure,” saying the failure prevented law enforcement from freezing roughly $30 million in stolen funds. Those statements remain ZachXBT’s allegations, and the source report did not include a response from the bank to the accusation.

Reported MiCA License Plans

The allegation surfaced as the banking group prepares to expand into crypto services. French financial newspaper L’Agefi reported in May that Crédit Mutuel Arkéa had applied for a license under the EU’s Markets in Crypto-Assets (MiCA) rulebook, the bloc’s licensing regime for crypto-asset service providers. The reported plan was to offer services to retail customers through Arkéa Banking Services on a white-label basis. The bank has not connected the incident to its reported crypto plans.

Decrypt reported the allegation days after the $6.3 billion Binance hack, which the FBI attributed to North Korean hackers. ZachXBT said the suspected attacker in the EU case remained unidentified and that he could rule out Lazarus Group, the North Korea-linked hacking collective, with a “high degree of confidence,” citing multiple laundering indicators.

The bank said some operations were gradually resuming after security measures were strengthened. The amount affected remains under assessment, and the group has not confirmed whether cryptocurrency was involved. ZachXBT’s account of the exchange withdrawals remains an allegation in the reporting, and the method by which the attacker accessed the exchange accounts has not been explained. The outstanding items to track are the group’s final loss assessment, its answer on whether cryptocurrency was involved, and whether law enforcement is able to freeze or recover any of the funds.