French Cooperative Bank Crédit Mutuel Arkéa Hit by Cyberattack as Investigators Trace Over $133M Through Crypto Exchanges
French Cooperative Bank Crédit Mutuel Arkéa Hit by Cyberattack as Investigators Trace Over $133M Through Crypto Exchanges #
Crédit Mutuel Arkéa, the Brittany-based French cooperative bank, has confirmed it was the victim of a cyberattack that enabled fraudulent transactions, following disclosures by an independent blockchain investigator who traced more than $133 million in suspected stolen funds through major cryptocurrency exchanges.
The bank issued a statement on Wednesday, November 4, saying it had detected and contained the attack and had temporarily suspended certain transactions to prevent further fraudulent movements. It told customers their assets were safe and that any delays in transfer execution were a consequence of the precautionary measures it had put in place. Crédit Mutuel Arkéa, which manages nearly $238 billion in assets and is part of the wider Crédit Mutuel group, said the financial impact was not of a scale to threaten its stability, and it has notified the relevant authorities.
The incident first came to light publicly on November 2, when pseudonymous blockchain sleuth ZachXBT flagged suspicious withdrawals of more than $106 million from cryptocurrency exchange accounts. ZachXBT subsequently identified an additional $27 million in withdrawals, bringing his total estimate to over $133 million (roughly €118 million), and attributed the funds to the French bank.
Blockchain analytics firm Bitquery separately tracked approximately $108.8 million in USDC, a dollar-pegged stablecoin, leaving accounts at Kraken, Crypto.com, and OKX over a 21-hour window on November 1 and 2. The firm identified 178 withdrawals flowing to 15 wallets, though it was unable to independently confirm the full reported loss or identify the victim institution. Investigators believe the operation may have begun with unauthorised traditional banking transfers before proceeds were routed into digital asset platforms.
Crédit Mutuel Arkéa disputed the $133 million figure reported in the press, saying its own assessment indicated a lower sum, without disclosing the precise amount. The bank also declined to confirm whether the stolen funds took the form of cryptocurrency. It did not respond to questions about how the attackers gained access to its systems or whether any customer data was compromised.
Crypto.com said it had blocked funds connected to the incident and that its own customers’ assets remained secure. Stablecoin issuer Tether separately froze approximately $1.14 million in USDT linked to the attack. Investigators have not yet determined how the attacker gained access to the exchange accounts, and no group has claimed responsibility for the breach.
Copy link