French bank Crédit Mutuel Arkéa hit in cyberattack — up to $133 million stolen and systems shut down

Crédit Mutuel Arkéa, one of France’s largest banking groups, confirmed a cyberattack that siphoned roughly $133 million from its own accounts, converting the cash into cryptocurrency before dispersing it across multiple blockchains. The breach underscores how traditional financial institutions remain vulnerable to attackers who exploit both legacy systems and emerging crypto‑centric laundering methods. Readers who rely on banks for asset safety must understand the mechanics behind this breach to gauge their own exposure.

Scale and Mechanics of the Theft

The attack targeted the bank’s internal treasury rather than customer deposits, allowing thieves to move a lump sum that “did not belong to customers” without immediate public alarm. According to the bank’s statement, the stolen funds were swiftly turned into stablecoins—specifically USDC and USDT—which facilitated rapid cross‑border transfers without triggering traditional banking alerts. By using stablecoins, the perpetrators bypassed the slower, more regulated fiat settlement channels that banks typically monitor.

Blockchain analysts first noticed the outflow when ZachXBT, a cryptocurrency fraud investigator, posted an alert on 2 November 2026, noting an “EU entity… losing $106 M+ from multiple centralized exchange accounts” the previous day. The alert highlighted that the illicit actor was “aggressively swapping” USDC for ETH, a pattern that signaled a coordinated laundering operation rather than a one‑off hack. The rapid conversion to ETH and subsequent movement to instant exchanges amplified the difficulty of tracing the original source.

Use of Crypto Laundering Channels

After the stablecoin conversion, the thieves employed instant‑exchange platforms such as WellWallet and Keyrex to swap USDC/USDT for Ethereum, leveraging the high liquidity and low friction of these services. The chain of transactions did not stop at Ethereum; a portion of the assets was funneled into Monero (XMR) via the Wagyu platform, exploiting Monero’s privacy‑first design that obscures transaction trails. This step illustrates a deliberate escalation from transparent to opaque crypto assets to hinder forensic analysis.

Further complicating the trail, the attackers “bridged across multiple chains,” moving tokens between Ethereum, Binance Smart Chain, and other networks. Each bridge introduces a new set of smart contracts and custodial points, diluting the forensic signal and increasing the cost of a successful investigation. The multi‑chain approach demonstrates a sophisticated understanding of how to exploit the interoperability of modern blockchain ecosystems for illicit gain.

Implications for Banking Cyberdefenses

The breach reveals a critical gap: banks often secure their core banking platforms but lack integrated monitoring for crypto‑related transactions that can bypass conventional AML (anti‑money‑laundering) controls. While Crédit Mutuel Arkéa assures that “customer assets were unaffected,” the incident shows that internal treasury operations can become a high‑value target when attackers can move funds into crypto with minimal friction. The reliance on third‑party services for crypto conversion further expands the attack surface beyond the bank’s direct IT environment.

Investigators are still probing the “third‑party compromise,” suggesting that an external vendor or software component may have been the entry point. This aligns with a broader industry trend where supply‑chain vulnerabilities—particularly in fintech APIs and crypto‑exchange integrations—serve as low‑hanging fruit for threat actors. The incident also underscores the importance of real‑time blockchain analytics; the attack was only publicly identified after the illicit transfers appeared on a public ledger, highlighting a lag in internal detection capabilities.

What This Actually Means For You

1. Bank‑issued funds can be diverted into crypto without immediate customer impact, meaning your personal deposits may remain safe even as the institution suffers a loss.
2. Stablecoins like USDC and USDT are increasingly used as the first step in laundering large sums, so watch for any unexpected activity involving these tokens in your accounts.
3. Instant‑exchange platforms (e.g., WellWallet, Keyrex) can act as rapid conversion points, making it harder for regulators to freeze illicit assets before they disappear.
4. Monero’s privacy features are deliberately chosen by criminals to erase transaction histories, indicating that not all crypto is equally traceable.
5. Supply‑chain weaknesses in third‑party fintech services can expose banks to attacks that bypass traditional security layers.

Immediate Action Steps

If you hold any crypto assets through your bank or a linked service, enable multi‑factor authentication and set strict withdrawal limits to reduce the risk of unauthorized transfers. Monitor your statements for any unexpected stablecoin activity, even if the amounts seem small, as they may signal a broader laundering pipeline.

For those who rely on traditional banking services, consider diversifying where you keep large sums of cash and stay informed about your institution’s crypto‑risk policies. Request transparency from your bank regarding how they monitor and secure third‑party crypto integrations, and ask whether they employ real‑time blockchain analytics to detect suspicious movements.

Frequently Asked Questions

How much money was stolen from Crédit Mutuel Arkéa in the cyberattack?

The bank confirmed that approximately $133 million was taken from its own accounts and converted into cryptocurrency.

Which cryptocurrencies were used to launder the stolen funds?

Attackers first swapped stablecoins USDC and USDT for ETH, then moved some assets to Monero via Wagyu and bridged them across multiple blockchains.

Did the cyberattack affect customer deposits at Crédit Mutuel Arkéa?

According to the bank, customer assets were unaffected; the loss pertained solely to the institution’s internal treasury.

What Do You Think?

Given the bank’s reliance on third‑party crypto services, should financial institutions prioritize blockchain analytics over traditional AML tools to protect their own funds?