French bank Crédit Mutuel Arkéa confirmed that a cyberattack enabled fraudulent transfers from its own account, with the funds subsequently converted into cryptocurrency through specialized platforms. The bank said the incident had been contained and customer assets were unaffected, although some transfers were delayed.
The Block reported the confirmation on Nov. 5, 2026, at 12:00:14 UTC+8. The bank’s statement was released Wednesday, following onchain investigator ZachXBT’s public report on Nov. 2.
Bank has not confirmed a final loss figure
ZachXBT estimated losses at more than $133 million, warning that the figure could rise because the attack unfolded over several days and may have included additional over-the-counter transactions.
Crédit Mutuel Arkéa did not confirm an exact loss amount, but acknowledged the order of magnitude. It said some stolen funds had been blocked and that it was too early to provide a final figure.
The bank said its teams activated security measures as soon as the attack was identified to contain the incident and prevent further fraudulent movements. It also said the amounts involved would not undermine its financial strength or soundness.
Reported movement of the stolen funds
According to ZachXBT, the attacker moved funds through a series of transactions that included:
- Swapping USDC for ETH.
- Routing assets through instant exchanges, including WellWallet and Kyrrex.
- Converting funds into XMR through Wagyu.
- Bridging assets across multiple chains.
ZachXBT also said he had a “high degree of confidence” that the attacker was not associated with North Korea’s Lazarus Group. That assessment was his attribution judgment, not a confirmed identification of the attacker.
Crédit Mutuel Arkéa’s statement listed more than 12,000 employees, over 5.8 million members and customers, and total assets of €211.5 billion ($238.1 billion). The final loss amount remained unresolved at the time of the report.