Source publication time: November 5, 2026, at 12:00:14 UTC+8. This article covers the incident reported at that time.
French bank Crédit Mutuel Arkéa confirmed that a cyberattack enabled fraudulent transfers from its own account, with the funds subsequently converted into cryptocurrency through specialized platforms. In a statement released Wednesday, the bank said the incident had been contained and customer assets were unaffected, although some transfers were delayed.
Onchain investigator ZachXBT, who first publicly flagged the exploit on November 2, estimated losses at more than $133 million. The bank did not confirm an exact loss figure but validated the order of magnitude. It said some stolen funds had been blocked and that it was too early to give a final amount.
The reported route through crypto platforms
According to ZachXBT, the attacker moved stolen funds through transactions that included:
- Swapping USDC for ETH.
- Routing assets through instant exchanges such as WellWallet and Kyrrex.
- Converting funds into XMR through Wagyu.
- Bridging assets across multiple blockchains.
These movements were attributed to ZachXBT’s investigation. The supplied report does not identify the bridges, origin and destination chains, or their verification mechanisms, so it does not establish which cross-chain trust boundaries the funds passed through. It also does not attribute the initial compromise to a bridge.
ZachXBT cautioned that the loss estimate could rise because the attack unfolded over several days and may have involved additional over-the-counter transactions. He also said he had a “high degree of confidence” that the attacker was not associated with North Korea’s Lazarus Group.
What the bank confirmed
Crédit Mutuel Arkéa said its teams activated security measures as soon as the attack was identified to contain the incident and prevent further fraudulent movements. It reiterated that the incident had “no impact” on customers’ assets and caused only delays in executing certain transfers.
The bank said the amounts involved would not undermine its financial strength and soundness. According to its statement, Crédit Mutuel Arkéa had more than 12,000 employees, over 5.8 million members and customers, and reported total assets of €211.5 billion ($238.1 billion).
