Crédit Mutuel Arkéa has confirmed that a cyberattack led to fraudulent transfers from one of the French lender's own accounts, with the proceeds subsequently converted into cryptocurrency through specialized platforms. Blockchain investigator ZachXBT estimated the suspected theft at more than $133 million, an amount Arkéa said was broadly consistent with its preliminary findings while stressing that its investigation had not established a final loss figure.
The bank said in a statement released Wednesday that customer assets were unaffected and that it had contained the incident. Some of the stolen funds have been blocked, Arkéa said, although it did not specify how much had been recovered or frozen. The attack also delayed the processing of certain transfers while the lender responded to the breach.
The case places a major traditional financial institution at the center of an increasingly familiar pattern in crypto-related crime: attackers obtain access to conventional financial accounts, move value rapidly through stablecoins and other digital assets, then use cross-chain bridges and instant-conversion services to complicate tracing efforts.
Bank says the final loss remains under review
ZachXBT first publicized the suspected attack on Nov. 2, saying the activity appeared to have unfolded across several days. His estimate exceeded $133 million, though he cautioned that additional over-the-counter transactions could raise the eventual total.
Arkéa did not confirm ZachXBT's specific calculation, but said its own assessment supported the order of magnitude of the estimate. The lender said it was too early to publish a definitive amount, suggesting investigators are still reconstructing the unauthorized transfers and determining which assets remain recoverable.
The distinction matters for a breach of this scale. A transaction may be visible on a blockchain after funds enter the crypto system, but the initial movement from a bank account, subsequent conversions, and any private over-the-counter activity can take time to reconcile. Freezing assets also does not automatically mean they have been returned to the victim or will be available for recovery.
Crédit Mutuel Arkéa reported more than 5.8 million members and customers, over 12,000 employees, and EUR 211.5 billion in total assets, equivalent to about $238.1 billion. Its confirmation that customer holdings were not affected narrows the known immediate impact to an internal account, rather than deposits or balances held by retail and business clients.
Stablecoins and cross-chain swaps complicated the trail
According to ZachXBT's account of the movement, the stolen value passed through several crypto services and asset types. He said funds were swapped from USDC, a dollar-linked stablecoin, into Ether, the native asset of the Ethereum network.
The activity then allegedly involved instant-exchange services including WellWallet and Kyrrex, followed by conversion into Monero's XMR token through Wagyu. Monero is designed with privacy features that can obscure transaction flows more extensively than transparent blockchains such as Ethereum, where transfers and wallet balances can generally be viewed publicly.
ZachXBT also identified the use of bridges across multiple blockchains. A bridge allows users to move tokens or token representations between networks, which can fragment an asset trail across separate ledgers and services. This does not make funds impossible to trace, particularly when transfers touch identifiable service providers, but it increases the number of transactions and counterparties that investigators must examine.
The apparent sequence shows why stablecoins have become a frequent early step in digital asset thefts. Their dollar-based denomination can make it easier to move a known amount of value into blockchain markets, while highly liquid assets such as ETH can then be exchanged across a broad range of platforms. Privacy-focused tokens and cross-chain tools add further layers once funds have left the initial address.
ZachXBT said he had a high degree of confidence that the attacker was not connected to North Korea's Lazarus Group. The group has been linked by governments and blockchain investigators to several high-profile crypto thefts, but no attacker has been publicly identified in the Arkéa case.
Containment will depend on where funds surface
Arkéa's statement that part of the funds had been blocked indicates that at least some transfers reached entities able to restrict access to accounts or assets. Such measures can be valuable early in an investigation, especially when funds pass through centralized services that conduct customer identification checks or can respond to law-enforcement requests.
The chance of recovery tends to narrow as stolen value moves into services with less visibility, is split among many wallets, or is exchanged into assets designed to limit public tracing. The reported conversion into XMR could therefore prove consequential if it represented a substantial share of the stolen proceeds, though neither Arkéa nor ZachXBT has published a complete breakdown of the funds by asset or destination.
The episode also underlines that a bank cyberattack can become a crypto tracing case within hours. The initial breach may involve conventional payment infrastructure, internal access controls, or account authorization processes. Once money is converted into digital assets, the investigation expands to blockchain analytics, asset issuers, wallet services, exchanges, bridges, and potentially several national jurisdictions.
Arkéa has not disclosed how the attackers accessed the account used for the fraudulent transfers. It has also not indicated whether the incident involved compromised credentials, a technical intrusion, social engineering, or another method. Those details will be central to understanding whether the breach resulted from a weakness in internal controls, a third-party exposure, or a targeted attack against a specific process.
For now, the confirmed facts establish a substantial unauthorized transfer from a major French banking group, followed by a rapid attempt to move the proceeds through crypto markets. The eventual loss figure will depend on the bank's ongoing reconciliation work, the value of assets blocked so far, and whether investigators can identify and restrain funds before they disappear further into private transactions and privacy-oriented networks.
Worried about hacks and stolen crypto? Learn core protections in our guide crypto-safety standards every trader should know today.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
