Crédit Mutuel Arkéa confirms attack as ZachXBT raises theft estimate to $133M

Crédit Mutuel Arkéa, the French mutual-bank group ZachXBT describes as holding $235 billion in assets, confirmed to CoinDesk on November 4, 2026 that it was the target of a cyberattack that "enabled fraudulent transactions." The on-chain investigator put the stolen total at more than $133 million across USDC and USDT withdrawn on November 1, up from his initial $106 million figure after another $27 million in centralised-exchange withdrawals was identified; primary source is ZachXBT's broadcast via Decrypt. The bank has not disclosed the amount or whether the loss is fiat or crypto. Crypto.com has publicly blocked linked funds; Kraken and OKX did not respond to CoinDesk's request for comment.

What happened

ZachXBT first flagged the incident on Monday, November 2, as "a large financial institution in Western Europe was exploited and it's currently being covered up." He named Crédit Mutuel Arkéa on November 4 after linking the drained balances and the bank's size signature. The attacker's exchange accounts began emptying on November 1; blockchain-analytics firm Bitquery told CoinDesk it had traced $108.8 million in USDC withdrawn from Kraken, Crypto.com and OKX accounts over 21 hours on November 1 and 2. The firm could not independently verify the full loss or identify the victim before ZachXBT did.

The bank told CoinDesk it has "taken control of the incident," temporarily suspended certain transactions and notified authorities. Its spokesperson said: "This incident has no financial consequences for [our clients]. Their interests are fully protected." The attack vector has not been disclosed — API-key theft, insider access, credential compromise and session-token theft all remain on the table publicly.

ZachXBT published four Ethereum addresses tied to the operation; neither CoinDesk nor Decrypt reproduced them in their write-ups. He also stated he has "a high degree of confidence" that North Korea's Lazarus Group is not responsible, citing laundering indicators specific to this operation.

On-chain trail

• Funds left the exchanges as USDC and USDT.
• USDC was then swapped into ETH on-chain.
• Bitquery traced a transfer of 396 ETH into a Kraken deposit address. It did not say who controlled the receiving account or whether Kraken froze the funds.
• Remaining laundering steps per ZachXBT: instant exchanges, conversion to Monero, and bridging across multiple chains.
• The attacker moved on OTC as well — ZachXBT said the stolen total could be higher once OTC flow is counted.

Crypto.com's statement: "We are aware of this report and have taken action to block funds linked to the incident from moving through Crypto.com." It added that all user funds remain secure and accessible.

Numbers

• Theft estimate (ZachXBT, Nov 4): more than $133 million
• Initial estimate (Nov 3): more than $106 million, later revised up by $27 million
• USDC traced by Bitquery: $108.8 million out of Kraken, Crypto.com, OKX
• Window of withdrawals: 21 hours on Nov 1–2, 2026
• Transfer into Kraken deposit address: 396 ETH
• Ethereum addresses published: 4 (per ZachXBT; not reproduced by secondary outlets)
• Bank size per ZachXBT: $235 billion in assets
• Lazarus attribution: ruled out by ZachXBT with "a high degree of confidence"
• Confirmed exchange freeze to date: Crypto.com only; Kraken and OKX silent

What to watch

1. Whether Kraken and OKX publish freeze figures against the four ETH addresses ZachXBT shared. Crypto.com acted publicly; the other two have not.
2. How the attacker reached the exchange accounts — API-key theft, phishing, insider access, or a compromise on the bank side. The absence of a public mechanism three days in is unusual for a nine-figure theft.
3. AMF, ACPR and CNIL engagement. Arkéa confirmed to CoinDesk it notified authorities; whether the ACPR issues a supervisory notice and whether CNIL opens a GDPR breach probe will shape the disclosure timeline.
4. Treatment under MiCA Article 88 (incident reporting for CASPs) and bank-side notification under DORA, which took effect for EU financial entities in January 2025. Arkéa Banking Services has a pending CASP licence application; the incident lands as that file is under review.
5. ETH-to-Monero conversion figures once ZachXBT publishes the full laundering map. The post-conversion fraction becomes effectively unrecoverable at a public-explorer level.

Context

This is the second nine-figure drain on CEX-held balances flagged by ZachXBT in four days. On November 3 he described an unattributed $106M+ loss from an unnamed EU entity, routed through WellWallet, Kyrrex and Wagyu into Monero — the Arkéa case now appears to be that entity, with the figure revised up. The pattern — stablecoin withdrawal → ETH consolidation → instant-exchange and XMR exit — matches the laundering template documented after the DMM Bitcoin drain in 2024 and the WazirX multisig compromise, and is distinct from the TraderTraitor-attributed Binance $6.3B drain that ZachXBT is explicitly separating from this case.

Arkéa is France's fifth-largest mutual banking group and operates the online bank Fortuneo, retail subsidiary Fortuneo Banque, and white-label platform Arkéa Banking Services. French-language coverage (Cryptoast) has pointed to the Fortuneo online-banking surface as the entry side, though neither CoinDesk, Decrypt, nor the bank itself has confirmed that attribution.