French cooperative bank Crédit Mutuel Arkéa confirmed on Wednesday, November 4, 2026, a cyberattack that it says enabled "fraudulent operations". On-chain investigator ZachXBT links the attac
French cooperative bank Crédit Mutuel Arkéa confirmed on Wednesday, November 4, 2026, a cyberattack that it says enabled "fraudulent operations". On-chain investigator ZachXBT links the attack to outflows of more than $133 million that are said to have moved through crypto exchanges, stablecoins, ether and Monero. The bank has not yet given a figure and stresses that its customers' assets were not affected.
Two things are therefore documented: an attack the bank itself acknowledges, and a money trail that a well-known blockchain analyst is tracing in public. Whether the two belong together in full, Arkéa has so far neither confirmed nor denied. This article sets out what is established, what remains open and which precautions bank customers holding crypto should sensibly take now.
Crédit Mutuel Arkéa is part of the Crédit Mutuel group and has its roots mainly in Brittany and south-west France. According to its own statement on the cyberattack, the group employs more than 12,000 people, serves over 5.8 million members and customers and has total assets of €211.5 billion.
In the statement, which the trade outlet Decrypt reported on Wednesday, the bank writes that the incident is "closed and under control". Operations are gradually resuming now that reinforced security measures are in place. Customer assets were not affected, and the attack merely delayed the execution of certain transfers. The amounts involved are still being determined but are "in no way likely to call into question the soundness and financial health of the group".
Arkéa also says it informed the relevant supervisory authorities immediately after discovering the attack and suspended certain transactions as a precaution to prevent further fraudulent movements. The bank explicitly warns its customers about phishing attempts in the wake of the incident. According to Decrypt, the bank has not said whether crypto assets were directly affected or put a figure on the damage.
ZachXBT is a pseudonymous blockchain investigator who has spent years tracking thefts and frauds using public transaction data. On Monday, November 2, he reported, according to Decrypt, that an unnamed entity in the European Union may have lost more than $106 million from accounts at several crypto exchanges on November 1. The funds were withdrawn as USDC and USDT, stablecoins pegged to the US dollar.
On Tuesday he named Crédit Mutuel Arkéa on his Telegram channel as the alleged victim, describing it as a "French bank with $235 billion in assets". The attack, he said, stretched over several days. In an update the same day he added a further $27 million in exchange withdrawals, part of it only after his first post. That brings his total to more than $133 million. He also published four Ethereum addresses that he attributes to the theft.
According to Decrypt, ZachXBT has not disclosed how he identified the bank or how the attacker gained access to the exchange accounts. He expects the total to rise once over-the-counter deals are included. Such OTC (over-the-counter) trades are deals struck directly between two parties away from an exchange's public order book; they do not show up in exchange withdrawals.
The loss figures come from ZachXBT, as of November 4, 2026. Arkéa has not yet confirmed any amount.
The route ZachXBT describes follows a pattern investigators know from many large thefts. First, the attacker reportedly swapped USDC into ether. The reason lies in how stablecoins are built: issuers such as Circle can freeze USDC balances on addresses reported by authorities or investigators. Anyone who leaves stolen stablecoins sitting for long risks having them frozen. Ether has no issuer that could block an address.
In a second step, according to ZachXBT, the funds ran through so-called instant exchanges. These are swap services where you trade coins directly for other coins without a customer account of your own; for smaller amounts they often require no identity check. Part of the loot was then converted into Monero. Monero is a cryptocurrency that hides the sender, recipient and amount of a transaction by default, so payments on its blockchain can barely be traced.
The attacker also moved funds across several blockchains via bridges. A bridge links two blockchains: it locks coins on one side and issues a counterpart on the other. Each of these steps adds to the investigators' workload, because the trail spreads across different networks, each with its own analysis tools.
The case has so far left no visible mark on the market. According to CoinPaprika, Monero traded at around $635 on Thursday morning, 0.2 percent below the previous day, while ether rose 5.3 percent to about $2,430 over the same period. With daily turnover in the billions, even nine-figure sums disappear in the trading volume.
Sharper than the sum is ZachXBT's criticism of how the incident was handled. Before naming the bank, he wrote, according to Decrypt, that his working hypothesis was that a major financial institution in Western Europe had been attacked and that the case was currently being "covered up". He accuses the institution of failing to disclose the incident properly. As a result, he says, law enforcement could no longer freeze around $30 million of the stolen funds.
The bank describes events differently. According to its statement, it informed the supervisory authorities immediately after discovering the attack and took countermeasures at once. Exactly when Arkéa noticed the attack and when it notified the supervisor is not clear from the publicly available information. The accusation can therefore currently be neither confirmed nor refuted.
In practice, the dispute shows how heavily the chances of success in crypto thefts depend on speed. Exchanges and stablecoin issuers can only freeze balances while they still hold them. Once the coins have passed through swap services into Monero, recovery is usually out of the question. According to ZachXBT, the perpetrators are unknown; he says with "high confidence", however, that it is not North Korea's Lazarus Group, pointing to several characteristics of the laundering.
The timing is awkward. Arkéa has been preparing for the crypto business for months. According to a May report by the French financial newspaper L'Agefi, picked up by Decrypt, the group has applied for authorisation under MiCA. MiCA is the European Markets in Crypto-Assets Regulation; since the end of 2024 it has governed who may offer crypto services in the EU and which obligations apply.
With the licence, Arkéa wants to offer crypto services to its own retail customers and also pass them on to other institutions as a white-label solution through its Arkéa Banking Services unit. White label means that one provider supplies the technology and another company sells it to its customers under its own name. Whether the current attack will affect the authorisation process is open; the bank has not commented on it so far.
If you already buy crypto today, you should check that the provider is authorised. Which platforms hold a MiCA licence and how they differ is shown in our overview of regulated crypto exchanges. A licence does not prevent a hack, but it obliges the provider to keep client assets segregated, to maintain security safeguards and to report to the supervisor.
After the attack, Arkéa suspended certain transactions as a precaution and gradually brought operations back up.
For investors in Germany, the case is instructive above all because of one development: there, too, crypto trading is moving into the banking apps of retail banks. Volksbanks and Sparkassen have introduced trading in bitcoin and other coins or are preparing to. Our overview of crypto trading at Sparkasse summarises the current state of play.
In the bank model, you buy the coins through the familiar app, but they are held by a service provider in the background, the crypto custodian. That links two security questions: the IT of the bank you trade through, and custody at the partner. An attack on either of them does not automatically hit your coins, as Arkéa's statement that customer assets were untouched shows. It can, however, delay transfers and orders, and that is exactly what the French bank has admitted for certain transfers.
In concrete terms, it pays to look at the contract documents: who holds the coins, is the custodian itself supervised, and can you transfer your holdings to a wallet of your own? Not every bank offering allows withdrawals to an external address. If self-custody matters to you, clarify this before your first purchase.
The Arkéa case comes only a few days after the $6.3 billion attack on Binance, which Decrypt classifies as the largest known crypto theft and which the FBI attributes to North Korean hackers. Both cases share a route through crypto infrastructure, but their structure differs markedly.
At Binance, the attack hit a crypto exchange directly. At Arkéa, on current information, the target is a traditional credit institution whose funds are said to have been withdrawn via exchange accounts and then laundered. Here cryptocurrencies are the getaway vehicle, not the target. For investigators that makes a difference: the trail starts in the regulated banking system with full customer data but ends in networks where identities are missing or obscured.
What happened: On November 4, 2026, Crédit Mutuel Arkéa confirmed a cyberattack that enabled fraudulent operations. By his own account, ZachXBT is tracing more than $133 million that is said to have flowed out from November 1 via accounts at crypto exchanges and been swapped into Monero, among other assets; the bank has not confirmed any amount.
Are you affected? According to the bank, no customer assets were affected; only certain transfers were delayed. No link to customers in Germany is known. Even so, Arkéa warns of phishing, and experience shows that such waves after major incidents also hit customers of other banks whose names fraudsters use as a hook.
Our guide on how to store crypto safely explains the basics of secure custody, and our hardware wallet comparison compares suitable devices.
Statutory deposit protection covers balances in current, overnight and fixed-term accounts if a bank fails. Crypto assets are not covered, even if you bought them through your own bank. A different mechanism applies to them: under MiCA, an authorised provider must hold its clients' crypto assets separately from its own. If the provider becomes insolvent, the coins still belong to you.
Against theft at the provider itself, however, this segregation helps only to a limited extent. Whether and how a provider compensates customers after a hack depends on its reserves, insurance and business policy. In Arkéa's case the question does not arise, according to the bank, because customer assets were untouched; the group therefore bears the loss.
What is established is the attack and the bank's assurance that customer assets are untouched. The figure of more than $133 million so far comes from ZachXBT alone, as does the accusation of late disclosure. How large the loss really is and whether parts can be recovered depends on further information from the bank and the investigators. Regardless, three steps are worthwhile:
(As of November 5, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
