Crédit Mutuel Arkéa confirmed a cyberattack that enabled fraudulent operations, one day after ZachXBT named the French banking group as the alleged victim of a crypto theft exceeding $133 million. The bank said the incident was under control and customer assets were unaffected, but it did not disclose an amount taken or confirm crypto losses.
The group said operations were resuming gradually after it introduced stronger security measures. Some transfers had been delayed, and the bank temporarily suspended certain transactions to prevent further fraudulent movements.
Arkéa Confirms Cyberattack, Says Incident Is Controlled
In a statement shared with Decrypt on Wednesday, Crédit Mutuel Arkéa described the incident as “closed and now under control.” The bank said it informed relevant supervisory authorities as soon as it detected the attack. It also warned customers to watch for phishing attempts following the incident.
The bank said the amounts involved were “in any event not of a nature to call into question the solidity and financial health of the group,” according to Decrypt’s translation. It did not mention cryptocurrency or say how much was taken. Decrypt said it had asked the group whether the losses involved crypto.
The bank’s confirmation followed ZachXBT’s public identification of Crédit Mutuel Arkéa as the institution he believed had been targeted. His Tuesday Telegram post named the group and alleged more than $133 million in theft. The investigator said the attack lasted multiple days and that the amount could be higher when over-the-counter activity is counted.
ZachXBT Described Exchange Withdrawals and Transfers
ZachXBT first raised the suspected theft on Monday. He said an unnamed European Union entity may have lost more than $106 million from accounts at several crypto exchanges on November 1. He reported that funds were withdrawn as USDC and USDT.
According to ZachXBT, the attacker then swapped USDC for ETH, moved funds through instant exchanges, converted some funds into Monero, and bridged assets across multiple chains. He later said he had identified a further $27 million in exchange withdrawals, bringing the reported total to more than $133 million. Some withdrawals occurred after his first disclosure, he said.
ZachXBT also published four Ethereum addresses he said were linked to the theft. He did not explain how he identified the bank or how the attacker accessed the exchange accounts. The bank’s statement did not confirm those details or connect the fraudulent operations to the alleged crypto movements.
The investigator accused the institution of lacking “proper incident disclosure” and said that had prevented law enforcement from freezing some $30 million in stolen funds. Those statements were ZachXBT’s allegations. The source report did not include a response from the bank to that accusation.
Bank Had Reportedly Sought Crypto License
The allegation comes as the banking group has been preparing to expand into crypto services. French financial newspaper L’Agefi reported in May that Crédit Mutuel Arkéa had applied for a license under the EU’s MiCA crypto rulebook. The reported plan was to offer services to retail customers and provide them through Arkéa Banking Services as a white-label service.
Decrypt reported the allegation days after the $6.3 billion Binance hack, which the FBI attributed to North Korean hackers. ZachXBT said the suspected EU attacker remained unidentified and that he could rule out Lazarus Group with a “high degree of confidence,” citing multiple laundering indicators.
The bank said some operations were gradually resuming after security measures were strengthened. The amount affected remains under assessment, and the group has not confirmed whether crypto was involved. ZachXBT’s account of the exchange withdrawals remains an allegation in the reporting.
Readers can also review reporting on wallet permissions in a suspected Binance hack, a separate account of a crypto theft linked to a zero-day, and an explanation of crypto insurance after a major hack. These stories concern separate incidents and do not establish a link to the Arkéa allegations.
