Crédit Mutuel Arkéa confirms cyberattack as researcher reports $133 million loss

Bank confirms the attack

Crédit Mutuel Arkéa, the regional bank serving Brittany and other parts of western France within the Crédit Mutuel group, said on Wednesday, 4 November 2026 that it had been the target of a cyberattack. The intrusion allowed fraudulent transactions to be carried out, and the bank says the incident is now under control. It has not confirmed the amount taken. Le Télégramme put the loss at $133 million, about €118 million.

The bank has also notified French and EU regulatory and supervisory authorities, and it told customers the episode carries no financial consequences for them. The bank's statement says:

“This incident has no financial consequence for them.”

How the theft came to light

The alert came from ZachXBT, a pseudonymous American on-chain investigator whose work on crypto security and money laundering is recognised internationally. On Monday, 2 November, he flagged a suspected loss of $106 million at an unnamed European Union entity. On Tuesday, 3 November, he reported further withdrawals above $27 million and named the bank, whose assets he put at about $235 billion. He first gave these details on his Telegram account, and he later told BFM that the total could be higher if funds left the blockchain.

The investigator said the attack had lasted several days and that real losses could be higher if off-exchange activity were counted. He also said he had a high degree of confidence that the attacker was not linked to North Korea's Lazarus group.

Open questions on the money

The $133 million total is the investigator's figure, repeated in the press, and the bank has not confirmed it. The $106 million and $27 million components were flagged on different days, and the investigator has said the final amount could be larger. He also argued that the bank's delay in alerting authorities allowed more than $30 million to be laundered, funds that European authorities could have frozen.

Suspected loss flagged 2 November106

Further withdrawals flagged 3 November27

Combined total reported133

Suspected loss flagged 2 November

106 USD million

Further withdrawals flagged 3 November

27 USD million

Combined total reported

133 USD million

Data from the article text

BFM reported that the funds were sent to crypto exchanges and converted into stablecoins, which it described as the two largest on the market. BFM also noted that Crédit Mutuel Arkéa has been less advanced than other French groups on cryptocurrencies. In May the group filed for a European MiCA authorisation to offer crypto services to clients, a file that BFM said still appeared to be open.

What remains unclear

No details on how the intrusion was carried out have been published so far. The bank has not said which systems were affected or how long the fraudulent transactions ran. The reported figures rest mainly on the investigator's own tracing, which the bank has not endorsed. The bank has not yet provided a confirmed amount.