French banking group Crédit Mutuel Arkéa confirmed on November 4 that a cyberattack let thieves make fraudulent transfers from its own account, which were then turned into crypto. The bank's early estimate is about €100 million, roughly $112 million. It says customers' money was not touched. Investigator ZachXBT, who first flagged the theft, puts it above $133 million.

Key facts

  • Who: Crédit Mutuel Arkéa, a French banking group based in Brittany; investigator ZachXBT named it first
  • What: Attackers got in through a third-party provider's platform, sent money from the bank's own account to other firms, and converted it into crypto
  • How much: About €100 million by the bank's early estimate; ZachXBT says more than $133 million
  • When: Theft from November 1, 2026; ZachXBT named the bank and the bank confirmed the attack on November 4
  • Source: AFP via Boursorama (the bank's statement) and CoinDesk

The European victim of this week's big crypto theft has a name. French bank Crédit Mutuel Arkéa confirmed on November 4 that a cyberattack allowed "fraudulent operations" from its own account, AFP reported. The money was sent to other financial firms and then converted into crypto. The bank's early estimate of the loss is about €100 million (about $112 million), and an investigation has been opened.

That fits the theft we reported on November 4, when investigator ZachXBT said an unnamed EU organization had lost more than $106 million from accounts at several crypto exchanges. At the time we didn't repeat a bank's name that only one site had printed. ZachXBT has since named Arkéa and raised his estimate above $133 million, CoinDesk reported. The bank confirmed the attack to CoinDesk but not his figure.

What the bank says happened

Arkéa says the attackers came in through a platform run by an outside provider, not through its own systems. It denied reports that its online bank, Fortuneo, was the way in, Presse-citron reported. It suspended some transactions as a precaution and says the attack is now under control.

Arkéa says customers' money was not affected. Some customer transfers were delayed while it dealt with the attack.

Why the two numbers differ

The bank counts what left its account in euros. ZachXBT counts crypto he can trace on the blockchain, and says the real total may be higher once over-the-counter trades are added, BeInCrypto reported. Neither number is final. ZachXBT has also said he is highly confident North Korea's Lazarus Group is not behind it.

If you bank with Arkéa or Fortuneo

  • Expect fake "bank security" calls. When a bank is in the news, scammers call its customers about the "attack" and ask them to move money to a "safe account." A real bank never asks that.
  • Hang up and call the number on your card. Caller ID can be faked, and so can a name and account details. Here are the scripts fake bank and support callers use.
  • Ignore anyone offering to "recover" losses for a fee. Read how recovery scams work.

Still open: which provider's platform was used, and whether the exchanges that received the money can freeze more of it. We'll update this story when the bank or investigators say more.

Sources: AFP via Boursorama, Crédit Mutuel Arkéa victime d'une cyberattaque ayant permis des opérations frauduleuses (November 4, 2026), CoinDesk, ZachXBT names French bank Crédit Mutuel Arkéa as suspected victim of $133 million crypto theft (November 4, 2026), Presse-citron, Fraude chez Crédit Mutuel Arkéa : la banque en dit plus sur la cyberattaque (November 2026), BeInCrypto, ZachXBT tracked a $133M crypto theft for two days. Then he named the victim (November 2026).