Crédit Mutuel Arkéa says a cyberattack hit its transactions as a blockchain sleuth puts the loss at $133 million

Crédit Mutuel Arkéa, a French cooperative bank based near Brest in Brittany, said on Wednesday, Nov. 4, that it had suffered a cyberattack that let attackers carry out illicit transactions. In a press release posted on the Actusnews wire at 13:45 Paris time (4:45 a.m. PT), the group said that, as soon as it detected the attack, it contacted “the relevant authorities and supervisory bodies,” and that it decided, as a precaution, “to temporarily suspend certain transactions in order to secure operations.” The bank said operations would resume gradually during the morning after checks and “enhanced security measures.” Reuters reported the statement at 8:51 a.m. Eastern (5:51 a.m. PT), and wrote that the bank gave no further details about the transactions.

The bank put customer reassurance at the center of its message. The incident “has had no impact on their assets and has only caused a delay in the execution of certain transfers,” the release said of customers across its federations and subsidiaries, adding: “Their interests are fully protected.” A spokesperson told CoinDesk: “This incident has no financial consequences for [our clients].” The group did not give a figure. It said that the amounts affected, “which are still being assessed, are in any event not of a nature to undermine the Group’s financial strength and soundness.” According to Euronews, the bank told the French newspaper Le Parisien that it had frozen some funds.

The size of the loss comes from outside the bank. ZachXBT, an anonymous blockchain investigator, first reported the theft on Monday, Nov. 2, putting losses at more than $106 million without naming the victim, then found another $27 million in withdrawals and raised his estimate to more than $133 million, according to CoinDesk. He named Crédit Mutuel Arkéa as the suspected victim on his Telegram channel early Wednesday, CoinDesk reported, and said the total could climb once over-the-counter trades get counted. AFP wrote that reports put the loss at $133 million (118 million euros) and that the bank “did not give details on how the attack was carried out or who could be behind it, nor did it confirm the amount lost.” Euronews attributed the $133 million figure to the Brittany regional newspaper Le Télégramme.

Independent tracing offers a slightly lower, partial number. Analytics firm Bitquery traced $108.8 million in USDC, a dollar-pegged stablecoin, withdrawn from accounts at Kraken, Crypto.com and OKX over 21 hours on Nov. 1 and 2, according to CoinDesk, but it could not verify the full reported loss or identify the victim. Much of the money moved into ether, which no central issuer can freeze, CoinDesk reported, and The Next Web wrote that some funds later passed through Monero, a cryptocurrency built to make transactions hard to trace. Crypto.com said it had stepped in: “We are aware of this report and have taken action to block funds linked to the incident from moving through Crypto.com. All user funds remain secure and accessible,” a spokesperson told CoinDesk. Kraken and OKX did not immediately respond to CoinDesk.

How the money left the bank remains unconfirmed. Grégory Raymond, a crypto journalist and co-founder of the outlet The Big Whale, reported on X, citing unnamed sources, that the illicit transfers ran through Fortuneo, Arkéa’s online bank, according to Frandroid and France 3 Bretagne. In his account, the attackers sent transfers from Fortuneo to crypto-exchange accounts that they had opened themselves under fabricated identities, naming as beneficiary the exact account holder so the transfers would pass name-matching checks, Frandroid reported; the exchanges then converted the euros into stablecoins. Frandroid stressed that this scenario rests on anonymous sources and that Arkéa “ne l’a ni confirmé ni démenti” (has neither confirmed nor denied it). The Next Web, citing the French tech site Presse-citron, carried a similar account.

ZachXBT has also faulted the bank’s timing. According to Frandroid, he said the bank took too long to report the attack, and that more than $30 million may have slipped beyond reach while a fast alert to European authorities could have frozen those funds; the French business channel BFM Business carried the same criticism in a headline posted on X. The bank, for its part, says it contacted the authorities as soon as it detected the attack. ZachXBT said he had a “high degree of confidence” that North Korea’s Lazarus Group did not carry out the attack, citing differences in how the funds moved, according to CoinDesk. Investigators have not determined how the attacker accessed the exchange accounts, CoinDesk added.

Arkéa groups the Crédit Mutuel federations of Brittany and the south-west of France, affiliated local banks and about 40 subsidiaries, with 5.8 million clients and €211.5 billion in assets, according to Reuters and the bank’s own release, which lists Fortuneo, Monext, Suravenir and Arkéa Asset Management among them. That makes it a major French lender, though far smaller than BNP Paribas or Société Générale, Reuters noted. France 3 Bretagne reported a net profit of €230 million for the first half of the year, and Frandroid calculated that a loss of about €118 million would equal roughly a quarter of the group’s 2025 net profit of €450 million. The bank has also prepared to enter crypto services: CoinDesk, citing the French financial paper L’Agefi, reported that it applied in May for a license under the EU’s MiCA rules.

For customers, the bank’s practical warning concerns phishing. “Following this cyberattack, phishing attempts are possible,” the release said, urging customers never to share login IDs, passwords, card numbers or SMS validation codes and to contact their adviser directly if in doubt. France 3 Bretagne reported that Arkéa customers could not make transfers on Wednesday, Nov. 4, while the bank kept part of its operations blocked.

The attack lands amid a run of cyber incidents in Europe. Reuters noted last week’s theft of $6.3 billion in cryptocurrency from Binance and a wave of attacks on internet-connected fridges; AFP wrote that companies across Europe “are on heightened alert” after suspected hacks of supermarket fridges and freezers. Separately, France’s national blood service, the EFS, said late Tuesday that attackers on Monday raised temperature and defrost thresholds at three of its plasma cold-storage sites by hitting a refrigeration supplier; “No health consequences have been identified and no blood products were lost,” the EFS said, according to Euronews, and the Guardian reported that the EFS alerted France’s cybersecurity agency, ANSSI. No source has linked the bank attack to the cold-storage hacks. Arkéa said it “will provide updates on the situation as soon as new information becomes available”; this desk will follow any confirmed figure or explanation of the method.