Credit Mutuel Arkea Confirms Cyberattack Behind Suspected $133 Million Crypto Theft

Published November 4, 2026, 4:50 PM PKT. Based on the bank statements carried by CoinDesk and Ledger Insights on November 4, 2026 (primary source), ZachXBT's Telegram broadcasts of November 2 to 4, 2026, and Bitquery's on-chain analysis (secondary sources). The bank has confirmed the attack but has not confirmed the $133 million figure.

French cooperative bank Credit Mutuel Arkea confirmed on November 4, 2026 that it was the target of a cyberattack that enabled fraudulent transactions, ending two days in which the suspected victim of a theft exceeding $133 million from centralized crypto exchange accounts had no name and no statement. The confirmation, given to CoinDesk and to Ledger Insights, is the first time the bank has spoken about the incident that blockchain investigator ZachXBT flagged on November 2, and it turns a single investigator's allegation into a confirmed bank security incident, even as the amount stolen, the attack method, and whether the money started as fiat or crypto remain undisclosed.

The confirmation that ended two days of silence

“Credit Mutuel Arkea has been the target of an attack that enabled the execution of fraudulent transactions. The incident is now under control,” the bank said in a statement to Ledger Insights, which published the confirmation at 10:34 UTC on November 4. CoinDesk carried the same confirmation, reporting that the bank told it the attack had enabled fraudulent transactions but was now under control. The bank added, in both statements, that the incident has no financial impact on clients and that their interests are fully protected, that it temporarily suspended some transactions to prevent further losses, and that it notified the relevant authorities. It is still assessing the attack's consequences, CoinDesk reported. What the bank did not do is confirm ZachXBT's number: it disclosed neither the amount stolen nor whether the funds were originally held in traditional currency or cryptocurrency, and CoinDesk's report is explicit on that gap.

The $108.8 million trail Bitquery traced

The on-chain record behind the allegation is specific about the flows even where it stops short of naming the victim. According to blockchain analytics firm Bitquery, $108.8 million in USD Coin ($USDC) was withdrawn from accounts at Kraken, Crypto.com and OKX over 21 hours on November 1 and 2, 2026, moving to 15 wallets. Bitquery traced the funds through hundreds of wallets, with much of the money converted into Ether ($ETH), which a central issuer cannot freeze, CoinDesk reported. The firm also identified a transfer of 396 Ether into a Kraken deposit address, though it did not establish whether Kraken froze the funds or who controlled the receiving account. Bitquery itself cautioned that the blockchain data alone cannot prove the bank was the victim, and said the flow looked more like a trading or payments business than a custodied fund. ZachXBT's total is higher than Bitquery's traced figure: he first put losses at more than $106 million on November 2, then raised the estimate to more than $133 million on November 3 after finding another $27 million in withdrawals, and said the amount stolen could be higher once over-the-counter trades are included. He also said more than $30 million had already been laundered, with no signs of asset freezes by European law enforcement at the time he wrote.

What the bank did not say

Three gaps matter for readers trying to judge the scale of the incident. First, the amount: the $133 million figure is ZachXBT's estimate, not the bank's, and Bitquery's independently traced $108.8 million covers only part of it. Second, the asset: the bank has not said whether the stolen funds were fiat balances later converted into crypto, or crypto held on exchange accounts, a distinction that decides which regulator, which insurance, and which recovery route applies. Third, the method: investigators have not determined how the attacker accessed the exchange accounts, CoinDesk reported, and ZachXBT has not disclosed how access was gained. What is established on the exchange side is narrower: Crypto.com confirmed it intervened, saying it had taken action to block funds linked to the incident from moving through its platform and that all user funds remain secure and accessible, while Kraken and OKX did not immediately respond to CoinDesk's request for comment. The exchanges have said their own platforms were not breached.

A bank about to enter crypto

The timing is uncomfortable for Arkea. The bank, which CoinDesk puts at more than $250 billion in assets under management, had been preparing to enter the cryptocurrency business: in May, French financial newspaper L'Agefi reported that it applied for a license under the European Union's MiCA rules to offer crypto services to retail customers and other financial institutions. The incident also lands under the EU's Digital Operational Resilience Act, which took effect in January 2026 and requires banks to file an initial report on a major ICT incident within four hours of classifying it as such, Ledger Insights reported. In France that report goes to the ACPR, the banking supervisor, which passes it to the European Central Bank for the largest banking groups. ZachXBT, for his part, said he had a high degree of confidence that North Korea's Lazarus Group did not carry out this attack, citing differences in how the stolen funds were moved compared with the group's usual pattern, a notable distinction one week after the FBI attributed the $6.3 billion Binance hack to North Korean actors.

What happens next

The next disclosures will decide whether this stays a $133 million allegation or becomes a confirmed nine-figure bank loss. Watch for a fuller bank statement or regulatory filing that puts a number on the theft and says whether the funds were fiat or crypto, for the ACPR or ECB track under the DORA reporting regime, for any exchange freezing or recovery announcement beyond Crypto.com's block, and for ZachXBT's further tracing, including whether the over-the-counter trades he flagged push the total higher. Until then, the honest summary is narrow: a major French bank confirms it was attacked and that fraudulent transactions were executed, a respected investigator estimates the theft above $133 million, and $108.8 million of that is traced on-chain. The theft is confirmed as an incident; its size is not. This article is news reporting and is not investment advice.

Sources

• Credit Mutuel Arkea, bank statements to CoinDesk and Ledger Insights, November 4, 2026, primary source: attack enabled fraudulent transactions, incident now under control, no financial impact on clients, interests fully protected, some transactions temporarily suspended, relevant authorities notified, consequences still being assessed, amount and fiat-or-crypto origin not disclosed
• CoinDesk, ZachXBT names French bank Credit Mutuel Arkea in $133M crypto exchange theft (November 4, 2026, secondary source: ZachXBT November 2 $106 million flag and November 3 $133 million revision, Bitquery $108.8 million traced withdrawals, Ether conversion, 396 Ether Kraken deposit transfer, Crypto.com block, Kraken and OKX no immediate response, bank over $250 billion assets under management, May L'Agefi MiCA license report, high confidence against Lazarus attribution)
• Ledger Insights, Credit Mutuel Arkea confirms it was the target of suspected $133m crypto theft (November 4, 2026, secondary source: bank statement wording, authorities contacted, DORA four-hour initial report rule, ACPR to ECB route)
• ZachXBT, Telegram broadcasts, November 2 to 4, 2026, via CoinDesk and Cointelegraph (secondary source: unnamed EU entity flag, $27 million additional withdrawals, cover-up accusation, naming of Arkea on November 4, withdrawals continuing after the first warning, more than $30 million laundered)
• Bitquery, on-chain analysis, November 2026, via CoinDesk (secondary source: $108.8 million in USD Coin withdrawn from Kraken, Crypto.com and OKX over 21 hours on November 1 and 2 to 15 wallets, hundreds of wallets traced, chain cannot confirm the bank as victim)