By French banking group Crédit Mutuel Arkéa has confirmed that it suffered a cyberattack that enabled fraudulent transactions, a day after on-chain investigator ZachXBT identified the institution as the suspected victim of more than $133 million in illicit withdrawals routed through cryptocurrency exchanges.
The bank said on November 4 that the incident had been contained and that operations were gradually resuming after it temporarily suspended certain transactions. It also notified the relevant authorities and supervisory bodies.
Crédit Mutuel Arkéa did not confirm ZachXBT’s $133 million loss estimate and said the amount affected was still being assessed. It stressed that customer assets were not affected and that the incident was not large enough to threaten the group’s financial strength.
What Has the Bank Confirmed?
Crédit Mutuel Arkéa said the attack allowed fraudulent transactions to be carried out, marking the first official confirmation that the institution identified by ZachXBT had experienced a security incident.
The group said it suspended some transactions after detecting the attack to prevent additional fraudulent movements, completed security checks and implemented enhanced protective measures before gradually restoring operations.
The bank did not disclose how the attackers gained access, which accounts or systems were compromised, whether the stolen funds originally existed as fiat currency or digital assets, or how much money had ultimately been lost.
It said the incident had caused delays in some transfers but had no financial impact on customers.
Crédit Mutuel Arkéa reported €211.5 billion in total assets and more than 5.8 million members and customers. Even if ZachXBT’s estimate proves accurate, the reported loss would represent only a small fraction of the group’s balance sheet, although the operational and cybersecurity implications remain substantial.
Investor Takeaway
The bank’s confirmation resolves the biggest uncertainty in the initial $133 million investigation: the suspected victim has now acknowledged a cyberattack and fraudulent transactions. What remains unconfirmed is whether ZachXBT’s traced crypto flows represent the full financial loss.
How Did ZachXBT Reach the $133 Million Estimate?
ZachXBT first reported on November 2 that an unidentified European entity had suffered more than $106 million in suspicious withdrawals from accounts at centralized exchanges.
He raised that figure above $133 million the following day after identifying an additional $27 million in withdrawals, including transactions that occurred after his first public disclosure.
Blockchain analytics firm Bitquery separately traced approximately $108.8 million in USDC withdrawn from accounts associated with Kraken, Crypto.com and OKX over a roughly 21-hour period.
Bitquery found that $62.98 million in stablecoins was converted into 27,553 ETH within about four hours. ZachXBT also documented transfers through instant exchanges, cross-chain bridges and services used to convert assets into Monero.
He now says the final loss could be higher than $133 million because over-the-counter transactions may not be visible in the blockchain activity he has traced.
The bank itself has not validated those figures, so the $133 million total remains an investigator estimate rather than an officially reported loss.
Why Does the Laundering Timeline Matter?
ZachXBT has criticized the institution over what he described as a delayed response, arguing that more than $30 million was able to move beyond easily recoverable routes before exchanges, stablecoin issuers or authorities could intervene.
Crédit Mutuel Arkéa’s statement presents a different timeline, saying it contacted the relevant authorities and supervisory bodies as soon as the attack was detected. Neither side has publicly disclosed enough timing data to establish when the bank first became aware of the compromise relative to the withdrawals identified on-chain.
The incident again demonstrates the narrow intervention window created when stolen funds are initially held in centrally issued stablecoins. USDC and USDT can be frozen at the issuer level, but that control disappears after the assets are converted into cryptocurrencies such as ETH or moved through services outside the issuer’s direct reach.
The same limitation was visible during the Binance breach, where Tether and Circle froze large stablecoin balances while other assets moved beyond immediate issuer control.
A separate $93 million Ledger-related theft investigation similarly showed how attackers can complicate recovery by converting stablecoins, bridging funds and dispersing assets across multiple networks.
Investor Takeaway
The critical unresolved issue is no longer whether Crédit Mutuel Arkéa experienced an incident, but how quickly the compromise was detected and whether faster coordination could realistically have stopped more of the funds before they were converted or dispersed.
Was North Korea Involved?
ZachXBT said he has a “high degree of confidence” that the attacker is not associated with North Korea’s Lazarus Group, based on differences in laundering behavior.
That assessment is based on transaction patterns rather than a confirmed attribution to another actor. No law-enforcement agency has publicly identified the attacker, and Crédit Mutuel Arkéa has not disclosed any information about who it believes carried out the breach.
The method of compromise also remains unknown. Earlier blockchain analysis suggested that the attacker obtained access to several exchange accounts and potentially to previously used withdrawal wallets, but on-chain data alone cannot show whether the initial breach involved stolen credentials, compromised internal systems, social engineering or another attack vector.
Crédit Mutuel Arkéa said it is continuing to assess the consequences of the attack and strengthen its security controls. It also warned customers to watch for phishing attempts exploiting publicity around the incident.
Investor Takeaway
The bank’s confirmation significantly strengthens the underlying incident record, but several financially important facts remain open: the final loss, the attack vector, the amount frozen or recovered, the role of exchange accounts and whether additional OTC-linked losses push the total above $133 million.