Crédit Mutuel Arkéa confirms cyberattack after ZachXBT ties French bank to $133 million crypto theft
The French cooperative bank says fraudulent transactions went through but client assets are safe. It has not confirmed the amount. On-chain sleuths traced more than $100 million in stablecoin withdrawals from exchange accounts.
TL;DR
- Crédit Mutuel Arkéa said on Nov. 4, 2026 that a cyberattack had enabled fraudulent transactions, that the incident is under control and that client assets were not affected.
- Blockchain investigator ZachXBT named the bank as the suspected victim of a theft of more than $133 million; the bank has not confirmed any amount, CoinDesk reported.
- Bitquery traced $108.8 million in USDC withdrawn from accounts at Kraken, Crypto.com and OKX over 21 hours on Nov. 1 and 2, 2026, much of it swapped into ether.
- Crypto.com said it blocked funds linked to the incident; ZachXBT said he has a "high degree of confidence" North Korea's Lazarus Group is not behind it.
A traditional bank has now been pulled into crypto's hack season. Crédit Mutuel Arkéa, a French cooperative banking group, said on Nov. 4, 2026 that it had been "the target of a cyberattack that enabled fraudulent transactions to be carried out," according to its official press release.
The bank says the incident "has been resolved and is now under control", that operations are gradually resuming and that the attack "has had no impact" on client assets. The amounts affected "are still being assessed" and are "not of a nature to undermine the Group's financial strength," it said.
What the on-chain trail shows
The story surfaced on-chain first. Investigator ZachXBT first reported on Nov. 2, 2026 that an unnamed EU entity had lost more than $106 million from several centralized exchange accounts, The Block reported. He later traced another $27 million in withdrawals, raising the total above $133 million, and named Crédit Mutuel Arkéa as the suspected victim. He said losses could be higher once over-the-counter trades are counted.
Analytics firm Bitquery traced $108.8 million in USDC withdrawn from accounts at Kraken, Crypto.com and OKX over 21 hours on Nov. 1 and 2, much of it converted into ether, which no central issuer can freeze, CoinDesk reported. Bitquery could not verify the full reported loss or identify the victim.
What is confirmed and what is not
The bank confirmed the attack and the fraudulent transactions, but not the $133 million figure, and did not say whether the funds were held in fiat or crypto, CoinDesk reported. Crypto.com said it had "taken action to block funds linked to the incident." ZachXBT said he has a "high degree of confidence" that North Korea's Lazarus Group did not carry out the attack. He also criticized the institution for allegedly letting more than $30 million be laundered before disclosure, per The Block.
Context matters here: the bank applied in May for a license under the EU's MiCA rules to offer crypto services, CoinDesk reported, citing L'Agefi.
What it means for Web3 teams – Analysis
This is the uncomfortable mirror image of the usual narrative. Banks like to say crypto is where the hacks happen; here, the money allegedly left a regulated bank through regulated exchanges, and the first public alarm came from an independent on-chain investigator, not the institution. Speed of disclosure is now a security control: every hour of silence is an hour in which stablecoins can be swapped into assets nobody can freeze. Teams that hold treasury on exchanges should keep withdrawal allow-lists, per-account limits and a pre-agreed freeze contact at every venue. This is not investment advice.
FAQ
What did Crédit Mutuel Arkéa confirm?
On Nov. 4, 2026 the bank said a cyberattack enabled fraudulent transactions, that the incident is under control and that client assets were not affected. It said the amounts are still being assessed.
Is the $133 million figure confirmed?
No. The figure comes from investigator ZachXBT. The bank has not confirmed any amount, and Bitquery traced $108.8 million in USDC withdrawals but could not verify the full loss.
Where did the money go?
According to Bitquery, the USDC was withdrawn from accounts at Kraken, Crypto.com and OKX and much of it was converted into ether. Crypto.com said it blocked linked funds.
Was North Korea involved?
ZachXBT said he has a high degree of confidence that North Korea's Lazarus Group did not carry out this attack.
Sources
- Crédit Mutuel Arkéa – press release: Crédit Mutuel Arkéa announces it has been the target of a cyberattack (Nov. 4, 2026)
- CoinDesk – ZachXBT names French bank Crédit Mutuel Arkéa as suspected victim of $133 million crypto theft
- The Block – French bank Crédit Mutuel Arkéa exploited for over $133 million, ZachXBT says
News summary based on the sources above. Not investment, legal or tax advice. Editorial policy & corrections · Report an error
Building in Web3? Turn the news into trust.
Positioning, KOL programs, LinkedIn systems and claim-safe content for Web3 and fintech teams.
Related
Nasdaq drops 5% as chip stocks crash 11%; bitcoin falls below $76,000 with $1B liquidated
Weak chipmaker reports and Democrats' midterm landslide erased the post-election rally on Nov. 5, 2026. Bitcoin did not hedge the sell-off: it fell with tech, while gold and Treasurys caught the safe-haven bid.
Google backstops Anthropic's $19 billion TeraWulf lease and could take a stake if Anthropic defaults
Three credit support agreements signed Nov. 4, 2026 put Google's AA+ balance sheet behind a 401 MW AI campus in Kentucky. If Anthropic stops paying, Google can take over the lease or buy into the project.
AMD's data center sales nearly double to $8.5 billion, but free cash flow drops to $554 million
AMD beat Q3 estimates and guided Q4 to about $17 billion. Beneath the record quarter, inventories rose by almost $3 billion and free cash flow fell 64% year over year.