Original report published Nov. 5, 2026, at 12:00:14 UTC+8.
French bank Crédit Mutuel Arkéa confirmed that a cyberattack enabled fraudulent transfers from its own account, with the funds subsequently converted into cryptocurrency through specialized platforms. The confirmation followed onchain investigator ZachXBT’s estimate that losses exceeded $133 million.
The bank did not confirm an exact loss figure, although it acknowledged the estimated order of magnitude. It said some stolen funds had been blocked and that it was too early to provide a final amount.
What the bank confirmed
In a statement released Wednesday, Nov. 4, the bank said the incident had been contained and customer assets were unaffected. It said its teams activated security measures after identifying the attack to prevent further fraudulent movements.
According to the bank, the incident caused delays in executing certain transfers but had no impact on customers’ assets. It also said the amounts involved would not undermine its financial strength or soundness.
The statement put the bank’s total assets at €211.5 billion ($238.1 billion). Crédit Mutuel Arkéa has more than 12,000 employees and over 5.8 million members and customers.
What ZachXBT reported—and what remains uncertain
ZachXBT first publicly flagged the exploit on Nov. 2. He estimated losses at more than $133 million and warned that the figure could rise because the attack unfolded over several days and may have involved additional over-the-counter transactions.
He reported that the attacker moved funds through several routes, including:
- Swapping USDC for ETH.
- Routing assets through instant exchanges such as WellWallet and Kyrrex.
- Converting funds into XMR through Wagyu.
- Bridging assets across multiple chains.
ZachXBT also expressed a “high degree of confidence” that the attacker was not associated with North Korea’s Lazarus Group. That remains his assessment, not a bank-confirmed attribution.
The crypto connection is the reported conversion and movement of stolen bank funds. The bank confirmed the cyberattack, but the final loss total remained unsettled, and the detailed transaction routes were attributed to ZachXBT’s investigation.