Crédit Mutuel Arkéa Confirms the Attack, Not the $133M Figure

A French bank has confirmed that it was robbed without saying how much was taken. Crédit Mutuel Arkéa said on Wednesday that a cyberattack had allowed fraudulent transfers out of its own account, and that the money was converted into crypto through specialized platforms. The onchain investigator ZachXBT had already put the loss above $133 million. The bank's statement carries no figure at all. It says client assets were untouched, the incident is contained, and some of the stolen funds have been blocked.

How the figure was built

ZachXBT first flagged the loss on 2 November, describing an unnamed European institution down more than $106 million across several centralized exchange accounts, withdrawn as USDC and USDT on 1 November. An update the next day added more than $27 million in further withdrawals, some made after his first post, taking his running total past $133 million. On 3 November he named the bank and said the attack "occurred for multiple days", adding that the real figure could be larger once over-the-counter activity is counted. A separate count exists. Bitquery, cited by Finextra, identified about $108.8 million in USDC leaving accounts at Kraken, Crypto.com and OKX across 1 and 2 November. Those two numbers measure different things and neither is the bank's. Counts that disagree mid-incident are familiar from Binance's hot wallet theft, put at $6.3 billion by the exchange and $5.9 billion by Chainalysis.

The order of magnitude is in dispute

What the bank actually endorsed depends on which outlet is reporting it. The Block writes that Crédit Mutuel Arkéa did not confirm the exact amount but validated the order of magnitude of the $133 million figure. Bitcoin Magazine writes that the theft is one the bank has not confirmed. Anadolu Agency, crediting BFMTV, writes that it did not confirm the reported amount. Finextra and Ledger Insights report only that the attack itself was confirmed. Five renderings of one statement, and they do not reconcile.

"While it is therefore still too early to communicate a final amount, we can already state that the amounts involved are in no way of a nature to undermine the financial strength and soundness of Crédit Mutuel Arkéa," the bank said.

Even the bank's size comes back two ways. ZachXBT's post, quoted by Decrypt, calls it a French bank with $235 billion in assets. The statement itself, per The Block, gives total assets of €211.5 billion, or $238.1 billion. Roughly $3 billion apart, on the fact that should have been easiest to check.

The route the money took

The Block reports that the attacker swapped USDC for ether, pushed assets through instant exchanges including WellWallet and Kyrrex, converted some into XMR through Wagyu and bridged across several chains. XMR is a privacy coin, and a conversion into one is where public tracing normally stops. Decrypt reported four addresses published by the investigator. Mixing venues have absorbed other stolen funds this autumn, among them the Drift exploiter's deposits back into Tornado Cash. Each of those hops is an observable transfer and none of them identifies anyone. ZachXBT said he has a high degree of confidence the attacker was not associated with the Lazarus Group, and he has named no alternative. On the way in, the bank has said only that this came from outside. Bitcoin Magazine reported that it rejected French press accounts pointing at Fortuneo, its online banking arm, and said the attackers came in through a service provider's platform. That account rests on one outlet.

Thirty million and a missing timeline

The investigator's sharpest complaint is about timing. Decrypt reported him accusing the bank of failing to carry out proper incident disclosure, saying the delay kept law enforcement from freezing some $30 million. Anadolu carried the same claim. Nothing read here shows the bank answering it. It has not said when the attack began, how long it ran, whether any data was taken, or what the loss comes to. By its own account that last one is not yet knowable. ZachXBT's running total stays the only public number.