€118 Million Stolen From Crédit Mutuel Arkéa as Bank Insists Deposits Are Safe
November 5, 2026 · Frisian News
Photo: Wikimedia Commons
Blockchain investigator ZachXBT traced more than €118 million in fraudulent transfers out of French bank Crédit Mutuel Arkéa. The bank confirmed the breach on November 4 but declined to verify the amount stolen and insisted customer deposits remain fully protected.
€118 million left Crédit Mutuel Arkéa through fraudulent transactions last week, according to blockchain investigator ZachXBT, who traced the funds across cryptocurrency platforms before the bank had issued a single public word.
The attack unfolded over several days. ZachXBT first flagged more than $106 million (€94 million) in suspicious withdrawals on November 2. Two days later, he raised his estimate to $133 million (€118 million) after identifying additional transfers. He named Arkéa publicly on the night of November 3 to 4, according to Stop Escroc. Arkéa, headquartered in Le Relecq-Kerhuon near Brest, holds over €230 billion in total assets and had 5.6 million customers at the end of 2025.
Blockchain analytics firm Bitquery, cited by Brussels Signal, recorded $62.98 million (€55.9 million) in stablecoins converted into 27,553 Ether in about four hours through the decentralised exchange UniswapX. The attackers drained capital from centralised exchange accounts, withdrew it as the dollar-pegged stablecoins USDC and USDT, and moved it across decentralised finance platforms before taking it off-platform entirely. Exchanges Kraken and Crypto.com say they restricted accounts or blocked funds linked to the incident, insisting their own systems were not compromised.
ZachXBT alleged that delays by the bank in alerting regulators and exchange compliance teams allowed the perpetrators to launder more than $30 million (€26.6 million) that could otherwise have been frozen. That allegation sits awkwardly against the EU's Digital Operational Resilience Act, which entered full application on January 17, 2025 and requires financial entities to submit an initial notification to national supervisors within four hours of classifying an incident as major, and no later than 24 hours after first detecting it.
On November 4, Crédit Mutuel Arkéa acknowledged the breach. "Crédit Mutuel Arkéa has been the target of an attack that enabled the execution of fraudulent transactions. The incident is now under control," the group stated, stressing the theft had "no financial impact" on retail clients and that customer deposits were "fully protected." As a precaution, the bank temporarily suspended certain transactions.
The bank declined to confirm the total amount stolen. ZachXBT's forensic transaction data and Bitquery's on-chain analysis identified the flows in real time while the bank stayed silent. According to Le Figaro, as reported by Epoch Times France, hackers targeted the bank's own funds rather than individual customer accounts, which would explain how Arkéa can simultaneously confirm a major theft and insist no client will lose money. Arkéa has not confirmed that account.
Arkéa has informed the Banque de France, which houses the Prudential Supervision and Resolution Authority. The ACPR forwards notifications on significant institutions to the European Central Bank. The Banque de France declined to comment to AFP. French cyber police and digital forensic teams are investigating. ZachXBT said he was confident the attacker was not linked to North Korea's Lazarus group, distinguishing this breach from the $6.3 billion (€5.6 billion) Binance heist on October 29, which the FBI attributed to IT workers linked to North Korea.
The theft lands amid a sustained assault on French digital infrastructure. In August, nearly 700,000 taxpayer records were stolen from the French tax authority. In July, a breach at the Ministry of National Education potentially exposed staff records going back to 2001. On October 11, refrigeration systems in hundreds of French supermarkets were remotely switched to defrost cycles in a sabotage campaign against food retail logistics, prompting Prime Minister Sébastien Lecornu to order the National Cybersecurity Agency to investigate.
A bank can confirm major fraudulent transactions and guarantee no customer loses a cent. Arkéa is asking the public to believe both.
Published November 5, 2026 · Frisian News