French banking and financial services group Crédit Mutuel Arkéa has confirmed it suffered a significant cyberattack resulting in the theft of approximately $133 million. The stolen capital belonged directly to the bank rather than its corporate customers, whose assets remained entirely unaffected throughout the security incident. The breach initially came to light publicly on November 2, 2026, when cryptocurrency analyst and blockchain fraud investigator ZachXBT published alerts regarding suspicious multi-million dollar withdrawals originating from centralized exchange accounts. Subsequent blockchain tracing by the investigator revealed that the financial tally climbed past $133 million following additional unauthorized withdrawals identified a day later.
Key takeaways
- Crédit Mutuel Arkéa confirmed a cyberattack resulting in the theft of roughly $133 million.
- The stolen funds belonged to the bank itself, and the institution stated customer assets are completely safe.
- Attackers siphoned funds through a third-party service provider rather than directly exploiting retail client accounts.
- Stolen capital was converted into cryptocurrencies such as USDC, USDT, Ethereum, and Monero before being laundered across multiple blockchains.
How the attackers laundered the stolen funds
According to detailed blockchain analysis, the illicit actors aggressively swapped stolen fiat currency and stablecoins into different digital tokens. The threat actors withdrew funds as USDC and USDT, subsequently exchanging them for Ethereum and transferring the assets through instant crypto exchange platforms including WellWallet and Keyrex. Portions of the stolen money were further converted into Monero via Wagyu, leveraging privacy-first tokens designed to make transaction tracking notoriously difficult. These illicit funds were ultimately bridged across multiple blockchain networks to effectively obscure their origin.
Cryptocurrency analyst ZachXBT publicly criticized the initial handling of the incident, arguing that a lack of prompt incident disclosure by the financial institution allowed more than $30 million in stolen assets to be laundered away before law enforcement could freeze them. The analyst noted that his working theory pointed to a major Western European financial institution whose exploitation was initially covered up, although he did not name the bank in his public warnings.
Bank response and ongoing investigation
Crédit Mutuel Arkéa addressed the public breach by explaining that the perpetrators breached the bank's systems by going through the platform of one of their third-party service providers. The banking group declined to name the specific vendor involved, though it explicitly ruled out Fortuneo after local press reports mentioned that name. As an immediate precautionary measure upon detecting the intrusion, management temporarily suspended certain transfer operations to secure systems and block further unauthorized transactions.
While the financial institution stopped short of officially publishing a precise accounting figure, executives stated they could validate the general order of magnitude of ZachXBT's $133 million estimate. Banking operations have since resumed gradually following comprehensive security checks and the implementation of enhanced safeguards across the network. Investigators have found no indications linking the security incident to the notorious North Korean hacking collective Lazarus Group, and no threat actor has claimed responsibility for the cyberattack thus far.
Comments