On November 2, 2026, ZachXBT reported a suspected theft of more than $106 million from an EU entity, later identified as the French bank Crédit Mutuel Arkéa. He has since raised his estimate to over $133 million. According to reporting by French journalist Grégory Raymond, the attackers sent transfers from the bank’s own account to accounts at centralized exchanges that they had opened under fake identities. On-chain tracing shows the fiat was converted into USDC and withdrawn to external wallets, then laundered to cover the trail. No crypto wallet belonging to the bank appears to have been emptied.
What the Bank Has Confirmed
On November 4, the bank confirmed a cyberattack that enabled fraudulent transactions, said the incident was contained, and temporarily suspended some transfers. The bank has not confirmed ZachXBT’s figure, but on November 5 it said about EUR 100 million ($112.6 million) was missing and that it could not yet say how much it would recover. The bank also said the attackers entered through a service provider’s platform. All figures in this post are estimates as of November 6.
Inside the Attack
The attackers used the bank’s own account to send transfers to other banks. According to on-chain tracing, the money was then converted into crypto through exchanges and laundered across chains.
The victim was unknown for two days. Late on November 3, ZachXBT named Crédit Mutuel Arkéa, a French cooperative banking group with about EUR 211.5 billion in assets and more than 5.8 million members and customers, as the likely victim. The bank confirmed a cyberattack the following morning.
The withdrawals went through the normal withdrawal function of the exchanges involved (Kraken, Crypto.com and OKX). Reportedly, on-chain data showed that 11 of the 15 receiving wallets had taken payouts from the same exchanges since May, which on-chain analysts first read as the bank’s own allowlisted addresses. The later French reporting points the other way: the accounts and the wallets belonged to the fraud network, which suggests a cash-out infrastructure that had been operating for months before this incident. From those wallets the funds were swapped mostly into ETH through UniswapX, partly into DAI, bridged across several chains, pushed through instant exchanges, and in part converted into Monero.
The exchange withdrawals took place over roughly 21 hours on November 1 and 2, although ZachXBT says the attack on the bank spanned several days. Reportedly, the first withdrawal left OKX at 12:25 UTC on November 1, with Kraken following 44 minutes later. Thirteen Kraken addresses were used in sequence over about six hours, several of them receiving a $1,000 test payment and, a minute later, the full balance, typically $5 million to $10 million. After his first alert, ZachXBT traced a further $27 million-plus to four more addresses, part of it withdrawn after his disclosure, which indicates the operation was still running.
Crédit Mutuel Arkéa has not disclosed the root cause. The bank places the point of entry at a service provider’s platform, not at Fortuneo, and describes a sophisticated external attack rather than human error. The exact access path is not public. The open question is how an attacker with access through a service provider could move transfers of this size from the bank’s own account, and how long it took to detect and stop them.
Lessons Learned from the Attack
Unlike many large crypto hacks of 2026, which targeted wallets and protocols directly, this incident shows that a bank does not need to hold a single digital asset to end up with a crypto incident. Crypto rails were the exit channel: KYC’d mule accounts at exchanges, payee-name matching that cannot stop a transfer sent to the mule’s own name, and a four-hour window in which $63 million in stablecoins became ETH that no issuer can freeze. The reported entry point, a service provider’s platform, also shows that a bank’s exposure includes the access it grants to third parties.
The case also shows the importance of prompt disclosure of security incidents involving digital assets. Some of the stolen assets, such as USDT and USDC, can be frozen by their issuers; however, this requires prompt notifications before the attacker swaps them into other crypto. In this case, ZachXBT argues that the lack of prompt disclosure let more than $30 million be laundered that EU law enforcement could have frozen. In practice, according to ZachXBT, Tether froze about $1.1 million in USDT, Circle froze none of the USDC while the attacker swapped $63 million into ETH over roughly four hours, and Kraken and Crypto.com restricted accounts and blocked funds only after the public alert.
Minimizing this risk requires testing incident response before it is needed, including the crypto side: on-chain tracing, freeze requests to issuers and exchanges, and law enforcement notification. Halborn’s Red Team Exercise can simulate this scenario, from compromise of a third-party provider’s access to the crypto cash-out, and test how an organization detects and responds. To learn more, get in touch with Halborn.