Crédit Mutuel Arkéa cyberattack: How did a French bank become linked to a $133 million crypto investigation?

Crypto investigators are following a trail of millions of dollars moving through cryptocurrency exchanges after French banking group Crédit Mutuel Arkéa confirmed a cyberattack involving fraudulent transactions. Blockchain investigator ZachXBT has linked the bank to more than $133 million in suspected withdrawals, though the institution hasn't confirmed the amount lost.

The bank disclosed the incident on November 4, after suspicious transactions had been traced across several platforms. While investigators have followed the money through different wallets and digital assets, how the attackers gained access remains unclear.

ZachXBT Traces Suspicious Withdrawals Across Crypto Exchanges

ZachXBT first flagged more than $106 million in suspicious withdrawals on November 2, initially describing the entity involved as unidentified, as per a Crypto Economy report. Further investigation uncovered more than $27 million in additional withdrawals, taking suspected total above $133 million.


In a November 3 Telegram update, he identified Crédit Mutuel Arkéa as the alleged victim and said the activity had continued over several days. He also noted the possibility of additional over-the-counter transactions.

Blockchain analytics firm Bitquery separately traced approximately $108.8 million in USDC withdrawals involving Kraken, Crypto.com and OKX and its analysis identified 178 transactions sent to 15 wallets over roughly 21 hours across November 1 and 2, according to Bitcoin.com.

Fortuneo Connection Raises Questions About the Attack

The suspected route into cryptocurrency markets may have started with traditional bank transfers rather than a direct breach of a crypto exchange.

French journalist Grégory Raymond reported that the alleged theft originated through Fortuneo, Arkéa's online banking subsidiary. According to his report, fraudsters allegedly directed unauthorized fiat transfers into exchange accounts opened using falsified identities before converting the money into digital assets and withdrawing it.

The bank hasn't confirmed this account and the method used to access its banking infrastructure remains unknown.

Investigators also traced approximately $63 million in stablecoins exchanged for 27,553 ether (ETH) during the night of November 1-2. Some transactions involved UniswapX, while subsequent movements reportedly passed through instant-swap services and Monero (XMR).

ZachXBT warned that more than $30 million that might have been eligible for freezing had potentially moved beyond straightforward recovery channels. Crypto.com also reportedly blocked funds linked to the incident, although the amount was not disclosed.

Crédit Mutuel Arkéa Says Customers Will Not Bear the Losses

In its November 4 statement, Crédit Mutuel Arkéa said the cyberattack had enabled fraudulent transactions and the bank notified regulatory authorities and temporarily suspended certain transfers while security teams worked to prevent further losses.

It later said the incident was under control and that operations were gradually resuming following additional verification procedures.

The bank assured customers that they would not bear the financial consequences and said the amounts involved would not undermine the group's financial strength. It has not disclosed an exact loss figure.

Arkéa serves more than 5.8 million members and customers. It also warned of potential phishing attempts following the incident and said its teams were continuing to assess the consequences and strengthen security measures.

Who Is Behind the Suspected Crypto Theft

The attacker remains unidentified. ZachXBT said he had a high degree of confidence that North Korea's Lazarus Group was not responsible, citing differences in laundering behavior.

Although investigators have traced substantial cryptocurrency movements, the available information does not confirm how the attack began or how much money was ultimately lost. The bank has confirmed the fraudulent transactions, but the more than $133 million estimate remains unverified as its final financial loss.