Crédit Mutuel Arkéa confirms cyberattack, validates ZachXBT's ~$133M loss estimate

Crédit Mutuel Arkéa, one of France's larger banking groups, said on Wednesday that a cyberattack allowed fraudulent transfers out of its own account, which were then converted into crypto through "specialized platforms." The confirmation, reported by The Block, followed on-chain investigator ZachXBT publicly flagging the theft on Nov. 2 and estimating losses at more than $133 million.

The bank did not put a final figure on the losses but validated the order of magnitude of ZachXBT's estimate. In its statement, it stressed that client assets were untouched — the fraudulent transfers came from the bank's own account, not customer accounts. "This incident has had no impact on their assets," the bank said, adding that it "only caused a delay in the execution of certain transfers." It said some of the stolen funds were blocked, and that the amounts "are in no way of a nature to undermine the financial strength and soundness of Crédit Mutuel Arkéa." The group reports total assets of €211.5 billion ($238.1 billion), with over 5.8 million members and more than 12,000 employees.

ZachXBT traced a multi-step laundering path: swapping USDC for ETH, routing assets through instant exchanges including WellWallet and Kyrrex, converting funds into the privacy coin Monero (XMR) via Wagyu, and bridging across multiple chains. He cautioned the total could rise, since the attack unfolded over several days and may have involved additional over-the-counter trades. He also said he has a "high degree of confidence" the attacker was not tied to North Korea's Lazarus Group.

Key facts

• Crédit Mutuel Arkéa confirmed a cyberattack enabled fraudulent transfers from its own account, converted to crypto (bank statement, via The Block, Nov. 5).
• ZachXBT estimated losses at more than $133 million; first flagged publicly Nov. 2 (ZachXBT, via The Block).
• Bank validated the order of magnitude but gave no final figure; said some funds were blocked and client assets unaffected (bank statement).
• Laundering route: USDC→ETH, via WellWallet and Kyrrex, into XMR via Wagyu, bridged across chains (ZachXBT).
• Bank reports €211.5bn ($238.1bn) total assets, 5.8M+ members (bank statement).

The real-world read

The order of events matters: the external investigator, not the bank, surfaced this first. Arkéa confirmed only after ZachXBT's Nov. 2 post, and still won't name a number — "too early," it says — while reassuring on everything it can quantify (client assets safe, solvency intact). That's a bank managing disclosure, so weigh the comforting lines accordingly. The hard forensic detail here comes from ZachXBT's on-chain tracing, not from Arkéa, which has disclosed no mechanism for how its account was drained. The Monero conversion is the telling part: once funds hit XMR, recovery odds drop sharply — consistent with ZachXBT's warning that the figure could climb.

This is news reporting, not financial advice.

Sources

• The Block (reputable secondary), Nov. 5 — reported the bank's confirmation and quoted statement, and relayed ZachXBT's findings. Not sponsored; The Block labels sponsored content separately.
• Crédit Mutuel Arkéa statement (primary, quoted via The Block) — confirmation, reassurances, asset figures.
• ZachXBT (primary on-chain research, via The Block) — $133M estimate, laundering route, Lazarus assessment.