A $133m French bank heist, told in pieces

A French banking group is telling customers their money is untouched after a reported eight-figure theft that first surfaced not in a regulatory filing but in a Telegram post. Crédit Mutuel Arkéa confirmed on November 4 that it had been the victim of “an attack that enabled fraudulent transactions to be carried out,” according to reporting by Infosecurity Magazine. The figure attached to the incident — $133m — did not come from the bank.

Instead, the number was assembled publicly by a blockchain investigator known as ZachXBT, who tracked suspicious withdrawals across multiple exchanges starting November 2. The result is a case where the victim’s public statements and an independent researcher’s on-chain observations have not yet been reconciled, and where the bank itself says it is still working out exactly what was taken.

How the money moved

According to Crédit Mutuel Arkéa’s FAQ on the incident, the attackers entered the bank’s network through the platform of a service provider. From there, they used Crédit Mutuel Arkéa’s own account to send transactions to other banking institutions, which the bank said potentially allowed the money to be converted into cryptocurrency through specialized platforms.

The bank was explicit that customer accounts were not the vehicle. “They did not, therefore, use customer accounts belonging to its federations or subsidiaries,” it said in the FAQ. It added that the incident has “no financial consequences for our customers.”

That distinction matters for how the event is categorized. The fraudulent transfers originated from a corporate account held by the institution itself, not from retail or business deposits held on behalf of customers. The bank said its teams activated security measures as soon as the attack was identified, in order to contain the incident and prevent further fraudulent activity against it.

The researcher’s running tally

The public timeline began two days before the bank’s statement. On November 2, ZachXBT posted on Telegram that an unnamed “EU entity” had lost $106m from “multiple centralized exchange accounts.” The investigator explicitly ruled out the Lazarus Group, the North Korean hacking operation that has been tied to numerous crypto thefts.

In that post, ZachXBT described rapid laundering activity: over the preceding 24 hours, the illicit actor had been “aggressively swapping USDC for ETH, transferring to instant exchanges (WellWallet, Kyrrex, etc), converting to XMR via Wagyu, and bridging across multiple chains.” The mix of swaps, instant-exchange transfers, privacy-coin conversion and cross-chain bridging describes a layering process designed to break the trail between the stolen funds and their origin.

The next day, ZachXBT posted an update claiming to have spotted an additional $27m in fraudulent centralized exchange account withdrawals, bringing the running total to the $133m figure now attached to the case.

“My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up,” they said. “No proper incident disclosure has resulted in $30m+ being laundered away which could have been frozen by EU law enforcement.”

— ZachXBT, blockchain investigator, in a Telegram post

That allegation of a cover-up is the researcher’s characterization, made before Crédit Mutuel Arkéa had publicly confirmed the incident. The bank’s subsequent statement confirmed an attack but disputed the framing of customer impact and did not confirm the $133m total.

The bank’s own accounting

Crédit Mutuel Arkéa’s FAQ pushes back on the certainty of the number. The bank said it was “still too early” to say for sure how much was taken, and that its teams were continuing work to precisely assess the financial consequences.

It also said some of the funds involved have been frozen, with other actions underway to recover them. And it sought to draw a line under the scale of the loss: “We can already confirm that the amounts involved are in no way likely to jeopardize the financial health and stability of Crédit Mutuel Arkéa.”

Those two statements — funds frozen, recovery actions in progress — sit alongside the researcher’s claim that more than $30m had already been laundered beyond the reach of EU law enforcement. Neither side has published a reconciled figure, and the bank has not confirmed the $106m or $27m tranches that make up the $133m total.

What the public record shows so far

The quantifiable elements of the story, as reported, break down as follows:

• $133m — the total loss figure assembled from ZachXBT’s two Telegram posts ($106m plus $27m).
• $106m — the initial sum the investigator attributed to an unnamed “EU entity” losing funds from multiple centralized exchange accounts.
• $27m — the additional fraudulent CEX withdrawals reported the following day.
• $30m+ — the amount ZachXBT said had been laundered away and could have been frozen by EU law enforcement.
• November 2 — the date of the investigator’s first public post on the incident.
• November 4 — the date Crédit Mutuel Arkéa issued its statement confirming the attack.

What is not in the public record is equally notable: the identity of the service provider whose platform was the entry point, the specific banking institutions that received the fraudulent transfers, and any independent confirmation of the dollar figures beyond the investigator’s on-chain analysis.

The service provider gap

The bank’s account places the initial intrusion outside its own perimeter — at a third-party platform used by a service provider. That detail, stated plainly in the FAQ, is the only technical attribution the institution has offered. It does not name the provider, describe the nature of the access, or say whether the provider’s systems were compromised or whether credentials were abused.

What the bank does describe is the subsequent step: using its own account to push transactions to other banking institutions. That implies the attackers operated within the bank’s transaction authority rather than by hijacking customer credentials, consistent with the bank’s insistence that customer accounts were not used.

The conversion path — from fraudulent bank transfers to cryptocurrency via specialized platforms — is the bridge between the traditional banking side of the incident and the on-chain activity ZachXBT observed. The investigator’s posts describe swapping USDC for ETH, moving funds to instant exchanges including WellWallet and Kyrrex, converting to XMR via Wagyu, and bridging across multiple chains. The bank’s FAQ describes the same destination in general terms, without naming any platform.

Phishing warning for customers

Even as it reassured customers about their balances, Crédit Mutuel Arkéa urged them to be on the lookout for potential phishing attempts in the aftermath of the incident and the publicity surrounding it. That warning is a standard follow-on risk in high-profile financial incidents: public attention to a bank’s name creates an opening for messages that impersonate the institution.

For customers, the bank’s position is that no funds were taken from their accounts and that the incident has no financial consequences for them. The bank has not published details of any customer-facing changes to authentication or account access.

Context of a costly month

The reported Arkéa incident lands in a crowded period for financial-sector theft. Infosecurity Magazine noted that the news came just days after North Korean hackers stole an estimated $6.3bn from cryptocurrency exchange Binance, described as the biggest theft of its kind ever seen.

In that comparison, the scale differs sharply — but the mechanics rhyme. Both involve large sums moved out of institutional accounts and into cryptocurrency, and both sit at the intersection of traditional finance and crypto rails, where funds can move quickly across exchanges and chains.

ZachXBT’s decision to rule out Lazarus in its November 2 post is itself a data point about how quickly such incidents are now compared against known North Korean operations. The investigator did not attribute the Arkéa activity to any known group in the posts cited.

Why this matters beyond one bank

The gap between the researcher’s $133m tally and the bank’s “still too early” assessment is the part worth watching. If the final, audited figure lands near the public estimate, the case would stand as one of the larger reported bank-linked thefts of the period; if it lands far below, the discrepancy would raise its own questions about how on-chain tracing maps to institutional accounting. Either way, the public has two parallel accounts — one from a bank that has confirmed an attack but not a number, and one from an investigator who has published a number but not a name.

The service-provider entry point is the second thread. A compromise that begins at a third party and reaches a bank’s transaction capability is the kind of supply-chain exposure that institutions cannot fully control on their own, and the bank’s refusal to name the provider leaves customers and other institutions unable to assess whether they share the same dependency. This suggests that third-party risk registers, not just internal controls, will be where the post-mortem focuses.

And the recovery claim — some funds frozen, more actions underway — is the part that will be tested by time. ZachXBT’s assertion that $30m+ had already been laundered past the point of freezing, if accurate, would mean recovery efforts are working against a shrinking pool. The bank has said the amounts involved will not jeopardize its financial health; the outstanding question is how much of the reported total can be clawed back, and how quickly the institution moves from reassurance to a precise, published accounting.