France: Crédit Mutuel Arkéa targeted by crypto theft of $133 million, according to ZachXBT

Breton silence. Since Monday, on-chain investigator ZachXBT has been tracking a “European financial institution” stripped of $106 million in stablecoins. He put a name on it on Telegram this Wednesday at 3:24 a.m. Paris time. The parent company of Fortuneo and Suravenir was allegedly “exploited for several days” for more than $133 million. The bank has not reacted and the bill could still rise.

Crédit Mutuel Arkéa: 211 billion euros in balance sheet and a hole of 133 million dollars

The message is in four lines, published on his Telegram channel:

“Update 2: I reveal that the European financial institution tapped for over $133 million is believed to be Crédit Mutuel Arkéa, a French bank that holds $235 billion in assets.

The attack on the bank took place over several days. I suspect the amount stolen is higher when OTC activity is taken into account. »

ZachXBT on Telegram, November 4, 2026 (JDC translation)

OTC activity refers to over-the-counter sales, which do not appear in the platforms' order books. The figure of 235 billion fits: the group had a balance sheet total of 211.6 billion euros at the end of 2025, for 5.64 million customers and 450 million euros in net profit.

Why would a mutual bank from Finistère hold $133 million in stablecoins on exchanges? Nobody knows yet. Crédit Mutuel Arkéa filed an application for MiCA approval (the European regulation on cryptoassets) in May to offer crypto services to its clients and white label via Arkéa Banking Services, according to L’Agefi. Its 2025 results press release does not mention any holding of cryptoassets for its own account.

The journey of 133 million Kraken to Monero

The detail comes from Bitquery. The first withdrawal is from OKX on November 1 at 12:25 UTC, the next from Kraken 44 minutes later. Bitquery details $108.8 million in USDC flowing from Kraken, Crypto.com and OKX to fifteen wallets in 21 hours. Kraken concentrates almost 95% of the total and 178 withdrawals. By 23:10 UTC, 98% had already slipped away. ZachXBT then added $27 million in withdrawals, some of which came after its first alert.

What follows reads like a whitewashing manual. On the night of November 1 to 2, the hacker exchanged $63 million in stablecoins for 27,553 ETH via UniswapX, at $2,286 each. Then, some go to instant exchangers like Kyrrex or WellWallet. He converts another to Monero via Wagyu.

As of November 2 at 1:47 p.m. UTC, there is $78 million identifiable on-chain, including $3.7 million USDC that Circle can freeze.

Kraken and Crypto.com told Cointelegraph that they restricted accounts or blocked funds related to the alleged theft. Both platforms assure that they have not suffered any intrusion. Finally, ZachXBT rules out the North Korean lead “with a high degree of confidence”.

A French bank in the dark and no one at the counter

ZachXBT wrote on Tuesday morning that the affair was “hushed up” and that the lack of communication had let slip more than 30 million dollars which could have been frozen. Twenty-four hours later, neither the bank nor its supervisors had issued a line. However, the European DORA regulation requires banks to notify their supervisory authority of a major IT incident no later than 24 hours after detecting it. Cointelegraph and The Block contacted Arkéa without response. No general French media had picked up the information on Wednesday at 6 a.m.

For customers of Fortuneo or Crédit Mutuel de Bretagne, there is nothing to indicate at this stage that the theft affects individual savings. In fact, withdrawals are made from accounts opened with exchanges, not from savings accounts or bank deposits. They may belong to Arkéa directly or to a service provider who operated for it. We are equally ignorant of the mode of intrusion. The first withdrawal dates from November 1st, the first public alert from the 2nd, and the name of the bank from the 4th.