The Crypto GuideStart learning
Menu
Prices: CoinGecko

Security & Scams

French bank group Crédit Mutuel Arkéa says a cyberattack enabled fraud, as ZachXBT ties it to a $133M crypto theft

A French bank group says a cyberattack enabled fraudulent transactions. ZachXBT ties it to $133M+ moved through crypto exchanges. What's confirmed and what isn't.

By Beginner5 min readPublished November 4, 202610 sources
On this page
  1. What the bank has confirmed
  2. What ZachXBT alleges
  3. What the exchanges say
  4. What this means for you

Key takeaways

  • Crédit Mutuel Arkéa, a French cooperative banking group, says a cyberattack allowed fraudulent transactions. It says the incident is under control, customers' holdings are not affected and it informed the authorities.
  • The bank has not confirmed any amount. Blockchain investigator ZachXBT alleges the bank is the victim behind more than US$133 million withdrawn from crypto exchange accounts as USDC and USDT.
  • Kraken says it restricted accounts linked to the suspected theft and that its own systems were not compromised. Crypto.com says it blocked associated funds. US customers of those exchanges were not reported as victims.

Crédit Mutuel Arkéa, a French banking group, said on November 4, 2026 that it had been hit by a cyberattack that allowed fraudulent transactions. The bank has not said how much was taken. Blockchain investigator ZachXBT alleges it is the victim behind more than US$133 million that moved out through crypto exchange accounts. [1] [3]

This is a bank story first and a crypto story second. Based on what has been reported, money was taken from the bank, then pushed through exchange accounts and stablecoins to make it harder to trace. None of the reports reviewed here says a crypto exchange or a blockchain was hacked.

What the bank has confirmed

In its statement, issued in French, the group says the attack made fraudulent transactions possible. As a precaution it temporarily suspended some transactions to stop further fraudulent movements. It says the incident is now under control, that operations were being restarted gradually during the morning, and that it told the relevant authorities and its supervisors when the attack was detected. [1]

For customers, the bank says their holdings are not affected and the only effect was that some transfers went out late. Le Monde, citing AFP, reported that some services, including certain transfers, were still unavailable to customers on Wednesday. It says the amounts involved are still being assessed, but that they do not threaten the group's financial strength. It also warned customers that phishing attempts may follow and told them never to share login details, card numbers or text-message codes. [1]

The group is made up of Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest and about 40 subsidiaries, including the online bank Fortuneo. It reports more than 5.8 million members and customers. [1]

What ZachXBT alleges

On November 2, ZachXBT posted on his Telegram channel that an unnamed EU entity was suspected of losing more than US$106 million from several exchange accounts the day before, withdrawn as USDC and USDT. He said he was highly confident the attacker was not North Korea's Lazarus Group. A later update raised his total to more than US$133 million [4], and a second one said the bank behind the losses was allegedly Crédit Mutuel Arkéa. He also said the amount may be larger once over-the-counter trades are counted. [2] [3]

Those figures are his on-chain estimates, not numbers from the bank. RTL, citing AFP, reports that the bank did not confirm the US$133 million (about €118 million) figure. Decrypt notes he did not explain how he identified the bank. ZachXBT also alleges that the lack of a proper public disclosure let more than US$30 million be laundered that EU law enforcement could otherwise have frozen. That is his unverified claim. The bank says it told the authorities and its supervisors as soon as the attack was detected, but does not address his claim directly. [4] [5]

How the money left the bank is not confirmed. French crypto outlet Cryptoast, relaying journalist Grégory Raymond's anonymous sources, reports that transfers went out from Fortuneo to exchange accounts opened under fake identities. Le Figaro, citing its own sources, also reports that Fortuneo was the part of the group that was hit. Neither the bank nor the exchanges have confirmed these accounts.

What the exchanges say

Kraken told Cointelegraph that the incident did not start on its platform, that it restricted the accounts in question and that it is working with law enforcement. It said its security systems were not compromised and no customer accounts were taken over. Crypto.com said it acted to block funds tied to what it called a third-party incident and that user funds are secure. OKX said it was looking into the matter. [5]

Blockchain-data firm Bitquery, as reported by Cointelegraph, estimated that about US$63 million in stablecoins was swapped into 27,553 ETH in roughly four hours. It also counted only US$1.1 million in USDT frozen by Tether at that point. These are outside estimates, not company figures. [5]

What this means for you

  • No reported US victims: the only named victim is a French bank, which has confirmed a cyberattack but not the crypto-theft figure. Kraken denies any breach of its own systems or takeover of customer accounts, and Crypto.com says user funds are secure.
  • Stablecoin freezes have limits: issuers can freeze USDT or USDC only while the tokens are still in a wallet they can act on. Once a thief swaps them for ETH or other coins, that option is largely gone. That helps explain why Bitquery counted so little frozen.
  • Watch for follow-up scams: big incidents bring fake "security" messages. The FTC warns that scammers pretend to be businesses or government agencies to get people to buy and send crypto. Never send funds because an unexpected message tells you to. [10]

This follows the Binance theft in late October and the Mercado Bitcoin incident earlier this week. Those are separate events, and nothing confirmed links them to this one. Still missing: the bank's own loss figure, how the attackers got in, and whether any money has been recovered. This is security news and education, not financial advice.

Frequently asked questions

Did Crédit Mutuel Arkéa confirm a $133 million crypto theft?

No. Its November 4 statement confirms a cyberattack that allowed fraudulent transactions, but says the amounts are still being assessed. The US$133 million figure and the link to crypto exchange withdrawals come from investigator ZachXBT and media reports, not from the bank.

Were Kraken or Crypto.com hacked?

Neither exchange says so. Kraken told Cointelegraph the incident did not start on its platform, that its systems were not compromised and that it restricted the accounts involved. Crypto.com said it blocked funds linked to the incident and that user funds are secure.

I'm a US crypto holder. Do I need to do anything?

There is no report of US exchange customers losing funds in this case. The practical step is to watch for phishing: big incidents are often followed by fake 'security' messages, and the bank itself warned its customers about that.

Sources

  1. Crédit Mutuel Arkéa annonce avoir été victime d'une cyberattaque (official statement, Nov 4, 2026) — Crédit Mutuel Arkéa via Actusnews Wire
  2. Community alert: EU entity suspected of losing $106M+ — ZachXBT (Telegram)
  3. Update 2: naming the alleged victim — ZachXBT (Telegram)
  4. Update: $133M+ total and disclosure allegation — ZachXBT (Telegram)
  5. Kraken restricts accounts linked to suspected $133M EU crypto theft — Cointelegraph
  6. ZachXBT Names French Bank Crédit Mutuel Arkéa as Alleged Victim of $133M Crypto Theft — Decrypt
  7. Crédit Mutuel Arkéa victime d'une cyberattaque ayant permis des opérations frauduleuses — RTL / AFP
  8. Crédit Mutuel Arkéa : la banque française victime d'un piratage massif — Cryptoast
  9. Le Crédit Mutuel Arkéa confirme avoir été victime d'une cyberattaque — Le Monde / AFP
  10. What To Know About Cryptocurrency and Scams — Federal Trade Commission

Published November 4, 2026 by . Educational content, not financial, legal or tax advice. Spot an error? Request a correction.

About the author

Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.

Full bio