# Crédit Mutuel Arkéa cyberattack and fund theft

> Developing situation record from CLSTR: https://clstr.news/situations/crdit-mutuel-arka-cyberattack-and-fund-theft
> Updated: 2026-11-04T19:52:26.000Z. Sources: 44. Developments: 2.

French banking group Crédit Mutuel Arkéa confirmed it was the victim of a cyberattack involving fraudulent operations. While the bank has not officially confirmed the specific loss amount, blockchain investigator ZachXBT estimated the theft exceeded $133 million, an increase from an initial $106 million estimate after tracing additional withdrawals. ZachXBT noted that the final figure could be even higher due to unrecorded over-the-counter activity.

On-chain analysis indicated that the suspected attacker moved funds through multiple centralized exchanges, including Kraken, Crypto.com, and OKX. Reports suggested approximately $62.98 million in stablecoins was converted into ETH within a four-hour window, with funds reportedly routed through instant exchanges and cross-chain bridges before being converted into Monero to obscure the trail. Bitquery reported that this conversion involved approximately 27,553 Ether.

The bank stated the incident is under control and emphasized that customers will face no financial consequences, as their interests remain protected. The attackers allegedly used the bank’s own accounts to facilitate transfers rather than accessing individual customer accounts. As a precaution, the bank temporarily suspended certain transactions and notified relevant authorities, including the Banque de France. Kraken has restricted accounts linked to the suspected theft and is cooperating with law enforcement.

Reports suggest the fraudulent transactions may be estimated at least 150 million euros. The breach reportedly targeted the bank’s online entity, Fortuneo, rather than individual client accounts. Experts suggest the attackers may have issued transfer orders from Fortuneo accounts to send money to global recipients. ZachXBT noted that the observed laundering patterns do not match those typically associated with North Korea’s Lazarus Group.

## Claims

- Crédit Mutuel Arkéa was the victim of a cyberattack. (reported by 15 sources)
- The theft involved withdrawals from multiple centralized exchanges. (reported by 13 sources)
- The attacker converted approximately $62.98 million in stablecoins into 27,553 ETH. (reported by 12 sources)
- ZachXBT estimated the suspected crypto theft from an unidentified EU entity has risen to more than $133 million. (reported by 11 sources)
- The victim is an unidentified entity in the European Union. (reported by 11 sources)
- Client accounts were not affected by the attack. (reported by 11 sources)
- Crédit Mutuel Arkéa confirmed it was the victim of a cyberattack involving fraudulent operations. (reported by 9 sources)
- The bank temporarily suspended certain transactions as a precaution. (reported by 8 sources)
- The attacker used Monero (XMR) to help obscure funds. (reported by 7 sources)
- ZachXBT stated with high confidence that the Lazarus Group was not responsible for the theft. (reported by 7 sources)
- Only $3.74 million in USDC remained that could potentially be frozen by Circle. (reported by 6 sources)

## Timeline

### 2026-11-04: Crédit Mutuel Arkéa suffers cyberattack involving approximately 118 million euros

French banking group Crédit Mutuel Arkéa reported a cyberattack involving approximately 118 million euros. The bank stated customer funds are unaffected and most operations have resumed.

4 sources. https://clstr.news/cluster/crdit-mutuel-arka-suffers-cyberattack-involving-100-million-euros

### 2026-11-02: Crédit Mutuel Arkéa confirms cyberattack following suspected $133M theft

French banking group Crédit Mutuel Arkéa confirmed a cyberattack involving fraudulent transactions. Estimates suggest over $133 million in crypto assets were stolen, though the bank says clients are unaffected.

42 sources. https://clstr.news/cluster/eu-entity-reportedly-loses-over-106-million-in-crypto-heist

---
Cite as: Crédit Mutuel Arkéa cyberattack and fund theft. CLSTR, https://clstr.news/situations/crdit-mutuel-arka-cyberattack-and-fund-theft