"of an attack that enabled fraudulent transactions to be carried out."
Crédit Mutuel Arkéa's account of the incident
On 4 November Crédit Mutuel Arkéa confirmed it had been the victim "of an attack that enabled fraudulent transactions to be carried out," and moved promptly to reassure customers that their funds were safe. In an FAQ published about the incident the bank said the attackers reached its network "via the platform of a service provider." The statement added that the perpetrators "used Crédit Mutuel Arkéa's own account to make transactions to other banking institutions, which then potentially allowed them to convert this money into cryptocurrency via specialized platforms."
The bank emphasised that "they did not, therefore, use customer accounts belonging to its federations or subsidiaries," and that "this incident has no financial consequences for our customers." Crédit Mutuel Arkéa said its teams "immediately activated the necessary security measures to contain the incident and prevent any further fraudulent activity against us."
ZachXBT's blockchain trace and the exchanges named
The first public signal came on 2 November when blockchain investigator "ZachXBT" posted on Telegram claiming an unnamed "EU entity" had lost $106m from "multiple centralized exchange accounts." ZachXBT described aggressive on-chain movement: "swapping USDC for ETH, transferring to instant exchanges (WellWallet, Kyrrex, etc), converting to XMR via Wagyu, and bridging across multiple chains."
On 3 November the investigator updated that an additional $27m of withdrawals had been spotted from fraudulent centralized exchange accounts. ZachXBT specifically ruled out involvement by the Lazarus Group in these transactions.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildTimeline and reported amounts: $106m, then $27m, and the bank's caveat
The public timeline in this incident is compact. ZachXBT's initial disclosure on 2 November cited $106m traced to centralized exchange accounts; an update a day later added about $27m more. Crédit Mutuel Arkéa, responding on 4 November, said it was "still too early" to say precisely how much was taken.
The bank reported that "some of the funds involved have been frozen, and other actions are underway to recover them" and asserted that the amounts involved are "in no way likely to jeopardize the financial health and stability of Crédit Mutuel Arkéa."
Customer impact and immediate containment steps from the bank
Crédit Mutuel Arkéa has explicitly told customers the incident "has no financial consequences" for them and warned of follow-on risks. The bank urged clients to be alert for potential phishing attempts in the wake of the publicity generated by the breach and subsequent blockchain tracing.
According to the FAQ, as soon as the attack was identified the bank's teams activated security measures intended to contain the incident and forestall further fraudulent activity. The institution also reported coordination to freeze some of the funds traced through exchanges and that additional recovery actions are in progress.
What this means for blockchain investigators, EU law enforcement, and centralized exchanges
- Blockchain investigators: Observers like ZachXBT continue to rely on on-chain tracing and exchange withdrawal visibility to attribute and quantify movement of stolen funds; in this case the investigator provided a stepwise narrative of swaps, instant-exchange transfers, XMR conversion via Wagyu, and bridging across chains.
- EU law enforcement: ZachXBT's write-up expressed concern that "No proper incident disclosure has resulted in $30m+ being laundered away which could have been frozen by EU law enforcement," signalling an expectation among investigators that law enforcement intervention can intersect with exchange controls to halt flows.
- Centralized exchanges: The chain of events described — transfers into "instant exchanges (WellWallet, Kyrrex, etc)" and conversion to privacy coin XMR via Wagyu — highlights the role exchanges and conversion services play in whether stolen funds can be frozen or rapidly laundered across chains.
The public record of this episode presents two concurrent threads: a bank statement promising customer protection and partial fund freezes, and a blockchain trace describing rapid conversion and dispersion through multiple exchange endpoints. Crédit Mutuel Arkéa says it is still assessing the total financial effect and is pursuing recoveries; independent tracing points to tens of millions in moved assets and warns of additional sums already converted or bridged. Which of those vectors—legal freezes, recovery actions, or irreversible blockchain swaps—will determine the final tally remains to be seen.
Source: Infosecurity Magazine — Crédit Mutuel Arkéa Targeted
