French banking group Crédit Mutuel Arkéa has confirmed that it was hit by a cyberattack that enabled fraudulent operations, one day after ZachXBT, a pseudonymous onchain investigator known for tracing stolen crypto funds, identified the bank as the alleged victim of a crypto theft exceeding $133 million.

In a statement shared with Decrypt on Wednesday, Crédit Mutuel Arkéa said the incident was “closed and now under control.” The bank said operations were gradually resuming after it implemented stronger security measures, and that customer assets had not been affected. The attack delayed the execution of some transfers, it said.

The bank did not mention cryptocurrency or disclose how much money was taken. It said the affected amounts were still being assessed, but were “in any event not of a nature to call into question the solidity and financial health of the group,” according to Decrypt’s translation.

Crédit Mutuel Arkéa said it notified the relevant supervisory authorities as soon as it detected the attack. It also temporarily suspended certain transactions as a precaution against additional fraudulent movements and warned customers to be alert for phishing attempts following the incident — a common follow-on risk after publicized breaches, when fraudsters pose as the affected institution. Decrypt said it had contacted the bank for further comment, including on whether the losses involved crypto assets.

ZachXBT’s allegations

“Disclosing the EU financial institution exploited for $133M+ is allegedly Credit Mutuel Arkea, a French bank with $235B in assets,” ZachXBT wrote on his Telegram channel on Tuesday: https://t.me/investigations/375

“The attack on the bank occurred for multiple days. I suspect the amount stolen is larger when accounting for OTC activity,” he added.

ZachXBT first reported the suspected theft on Monday, saying an unnamed entity in the European Union may have lost more than $106 million from accounts at several crypto exchanges on November 1. According to his original post, the funds were withdrawn as USDC and USDT. The attacker then swapped USDC for ETH, moved funds through instant exchanges, converted some of the assets into the privacy coin Monero — far harder to trace than transparent chains like Ethereum because its ledger conceals senders, recipients and amounts — and bridged funds across multiple blockchain networks, a laundering pattern commonly used in large crypto thefts to fragment transactions and obscure the origin of stolen funds.

In an update on Tuesday, ZachXBT said he had identified an additional $27 million in exchange withdrawals by the attacker, bringing the total to more than $133 million. He said some of those withdrawals occurred after his initial disclosure and published four Ethereum addresses that he said were linked to the theft: https://t.me/investigations/374

“My working theory is a large financial institution in Western Europe was exploited and it's currently being covered up,” ZachXBT wrote in his initial report. He accused the institution of failing to conduct “proper incident disclosure,” saying that this prevented law enforcement from freezing approximately $30 million in stolen funds.

ZachXBT did not explain how he identified the bank or how the attacker gained access to its exchange accounts. He also said the suspected attacker remains unidentified. However, he wrote that he could say “with a high degree of confidence it is NOT Lazarus Group,” the North Korean hacking collective, “based on multiple laundering indicators.”

The allegation follows reports that Crédit Mutuel Arkéa has been preparing to enter the crypto sector. In May, French financial newspaper L’Agefi reported that the group had applied for a license under MiCA — the European Union’s crypto regulatory framework, which created a pan-European licensing regime for crypto-asset service providers — to offer crypto services to retail customers and provide them on a white-label basis through its Arkéa Banking Services division:

The allegation also comes days after the $6.3 billion hack of Binance, described in the source report as the largest crypto theft on record. The FBI has attributed that attack to North Korean hackers. ZachXBT said the suspected EU theft does not appear to have been carried out by Lazarus Group based on the laundering indicators he reviewed.

Several questions remain open: the bank’s assessment of the affected amounts is ongoing, it has not said whether crypto assets were among the losses, and ZachXBT has said the total may be larger once over-the-counter activity is accounted for.

This story was updated to add comment from Crédit Mutuel Arkéa.