Crédit Mutuel Arkéa hack: ZachXBT traces $133M via crypto

Which topics should we dive deeper into?

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

French cooperative bank Crédit Mutuel Arkéa confirmed on Wednesday, November 4, 2026, a cyberattack that it says enabled "fraudulent operations". On-chain investigator ZachXBT links the attack to outflows of more than $133 million that are said to have moved through crypto exchanges, stablecoins, ether and Monero. The bank has not yet given a figure and stresses that its customers' assets were not affected.

Two things are therefore documented: an attack the bank itself acknowledges, and a money trail that a well-known blockchain analyst is tracing in public. Whether the two belong together in full, Arkéa has so far neither confirmed nor denied. This article sets out what is established, what remains open and which precautions bank customers holding crypto should sensibly take now.

Crédit Mutuel Arkéa hack: what the bank confirmed on November 4

Crédit Mutuel Arkéa is part of the Crédit Mutuel group and has its roots mainly in Brittany and south-west France. According to its own statement on the cyberattack, the group employs more than 12,000 people, serves over 5.8 million members and customers and has total assets of €211.5 billion.

In the statement, which the trade outlet Decrypt reported on Wednesday, the bank writes that the incident is "closed and under control". Operations are gradually resuming now that reinforced security measures are in place. Customer assets were not affected, and the attack merely delayed the execution of certain transfers. The amounts involved are still being determined but are "in no way likely to call into question the soundness and financial health of the group".

Arkéa also says it informed the relevant supervisory authorities immediately after discovering the attack and suspended certain transactions as a precaution to prevent further fraudulent movements. The bank explicitly warns its customers about phishing attempts in the wake of the incident. According to Decrypt, the bank has not said whether crypto assets were directly affected or put a figure on the damage.

ZachXBT and the $133 million: how the trail ran through crypto exchanges

ZachXBT is a pseudonymous blockchain investigator who has spent years tracking thefts and frauds using public transaction data. On Monday, November 2, he reported, according to Decrypt, that an unnamed entity in the European Union may have lost more than $106 million from accounts at several crypto exchanges on November 1. The funds were withdrawn as USDC and USDT, stablecoins pegged to the US dollar.

On Tuesday he named Crédit Mutuel Arkéa on his Telegram channel as the alleged victim, describing it as a "French bank with $235 billion in assets". The attack, he said, stretched over several days. In an update the same day he added a further $27 million in exchange withdrawals, part of it only after his first post. That brings his total to more than $133 million. He also published four Ethereum addresses that he attributes to the theft.

According to Decrypt, ZachXBT has not disclosed how he identified the bank or how the attacker gained access to the exchange accounts. He expects the total to rise once over-the-counter deals are included. Such OTC (over-the-counter) trades are deals struck directly between two parties away from an exchange's public order book; they do not show up in exchange withdrawals.

Laundering through stablecoins, ether and Monero: the alleged path of the loot

The route ZachXBT describes follows a pattern investigators know from many large thefts. First, the attacker reportedly swapped USDC into ether. The reason lies in how stablecoins are built: issuers such as Circle can freeze USDC balances on addresses reported by authorities or investigators. Anyone who leaves stolen stablecoins sitting for long risks having them frozen. Ether has no issuer that could block an address.

In a second step, according to ZachXBT, the funds ran through so-called instant exchanges. These are swap services where you trade coins directly for other coins without a customer account of your own; for smaller amounts they often require no identity check. Part of the loot was then converted into Monero. Monero is a cryptocurrency that hides the sender, recipient and amount of a transaction by default, so payments on its blockchain can barely be traced.

The attacker also moved funds across several blockchains via bridges. A bridge links two blockchains: it locks coins on one side and issues a counterpart on the other. Each of these steps adds to the investigators' workload, because the trail spreads across different networks, each with its own analysis tools.

The case has so far left no visible mark on the market. According to CoinPaprika, Monero traded at around $635 on Thursday morning, 0.2 percent below the previous day, while ether rose 5.3 percent to about $2,430 over the same period. With daily turnover in the billions, even nine-figure sums disappear in the trading volume.

Disclosure under pressure: ZachXBT's accusation and the bank's response

Sharper than the sum is ZachXBT's criticism of how the incident was handled. Before naming the bank, he wrote, according to Decrypt, that his working hypothesis was that a major financial institution in Western Europe had been attacked and that the case was currently being "covered up". He accuses the institution of failing to disclose the incident properly. As a result, he says, law enforcement could no longer freeze around $30 million of the stolen funds.

The bank describes events differently. According to its statement, it informed the supervisory authorities immediately after discovering the attack and took countermeasures at once. Exactly when Arkéa noticed the attack and when it notified the supervisor is not clear from the publicly available information. The accusation can therefore currently be neither confirmed nor refuted.

In practice, the dispute shows how heavily the chances of success in crypto thefts depend on speed. Exchanges and stablecoin issuers can only freeze balances while they still hold them. Once the coins have passed through swap services into Monero, recovery is usually out of the question. According to ZachXBT, the perpetrators are unknown; he says with "high confidence", however, that it is not North Korea's Lazarus Group, pointing to several characteristics of the laundering.

MiCA licence and bank crypto: Arkéa's plans for retail customers

The timing is awkward. Arkéa has been preparing for the crypto business for months. According to a May report by the French financial newspaper L'Agefi, picked up by Decrypt, the group has applied for authorisation under MiCA. MiCA is the European Markets in Crypto-Assets Regulation; since the end of 2024 it has governed who may offer crypto services in the EU and which obligations apply.

With the licence, Arkéa wants to offer crypto services to its own retail customers and also pass them on to other institutions as a white-label solution through its Arkéa Banking Services unit. White label means that one provider supplies the technology and another company sells it to its customers under its own name. Whether the current attack will affect the authorisation process is open; the bank has not commented on it so far.

If you already buy crypto today, you should check that the provider is authorised. Which platforms hold a MiCA licence and how they differ is shown in our overview of regulated crypto exchanges. A licence does not prevent a hack, but it obliges the provider to keep client assets segregated, to maintain security safeguards and to report to the supervisor.

Crypto trading at Sparkasse and Volksbank: who holds the coins in Germany

For investors in Germany, the case is instructive above all because of one development: there, too, crypto trading is moving into the banking apps of retail banks. Volksbanks and Sparkassen have introduced trading in bitcoin and other coins or are preparing to. Our overview of crypto trading at Sparkasse summarises the current state of play.

In the bank model, you buy the coins through the familiar app, but they are held by a service provider in the background, the crypto custodian. That links two security questions: the IT of the bank you trade through, and custody at the partner. An attack on either of them does not automatically hit your coins, as Arkéa's statement that customer assets were untouched shows. It can, however, delay transfers and orders, and that is exactly what the French bank has admitted for certain transfers.

In concrete terms, it pays to look at the contract documents: who holds the coins, is the custodian itself supervised, and can you transfer your holdings to a wallet of your own? Not every bank offering allows withdrawals to an external address. If self-custody matters to you, clarify this before your first purchase.

Binance hack and Arkéa attack: two cases, two attacker profiles

The Arkéa case comes only a few days after the $6.3 billion attack on Binance, which Decrypt classifies as the largest known crypto theft and which the FBI attributes to North Korean hackers. Both cases share a route through crypto infrastructure, but their structure differs markedly.

At Binance, the attack hit a crypto exchange directly. At Arkéa, on current information, the target is a traditional credit institution whose funds are said to have been withdrawn via exchange accounts and then laundered. Here cryptocurrencies are the getaway vehicle, not the target. For investigators that makes a difference: the trail starts in the regulated banking system with full customer data but ends in networks where identities are missing or obscured.

How to protect yourself from phishing after the Arkéa attack

What happened: On November 4, 2026, Crédit Mutuel Arkéa confirmed a cyberattack that enabled fraudulent operations. By his own account, ZachXBT is tracing more than $133 million that is said to have flowed out from November 1 via accounts at crypto exchanges and been swapped into Monero, among other assets; the bank has not confirmed any amount.

Are you affected? According to the bank, no customer assets were affected; only certain transfers were delayed. No link to customers in Germany is known. Even so, Arkéa warns of phishing, and experience shows that such waves after major incidents also hit customers of other banks whose names fraudsters use as a hook.

Official channel: Read messages from your bank only in the banking app or on the website you type in yourself, never via a link in an email or text message.
Call back: If someone claiming to be from the bank phones you, hang up and call the number on your bank card.
Read approvals: Do not confirm any order in your authentication app that you did not initiate yourself, not even for a supposed security check.
Harden access: Change reused passwords and use app-based two-factor login for exchange accounts instead of SMS.
Separate holdings: Coins you do not trade are better kept on a hardware wallet of your own than in a trading account, and you never hand over your recovery phrase.

Our guide on how to store crypto safely explains the basics of secure custody, and our hardware wallet comparison compares suitable devices.

Deposit protection and crypto assets: what is covered in a bank hack

Statutory deposit protection covers balances in current, overnight and fixed-term accounts if a bank fails. Crypto assets are not covered, even if you bought them through your own bank. A different mechanism applies to them: under MiCA, an authorised provider must hold its clients' crypto assets separately from its own. If the provider becomes insolvent, the coins still belong to you.

Against theft at the provider itself, however, this segregation helps only to a limited extent. Whether and how a provider compensates customers after a hack depends on its reserves, insurance and business policy. In Arkéa's case the question does not arise, according to the bank, because customer assets were untouched; the group therefore bears the loss.

Arkéa hack: the total stays open until the bank names figures

What is established is the attack and the bank's assurance that customer assets are untouched. The figure of more than $133 million so far comes from ZachXBT alone, as does the accusation of late disclosure. How large the loss really is and whether parts can be recovered depends on further information from the bank and the investigators. Regardless, three steps are worthwhile:

Check whether the platform you buy crypto through holds a MiCA authorisation, for example using our list of regulated crypto exchanges.
With a bank offering, find out who holds your coins and whether you can withdraw them to your own wallet; the state of play at Sparkassen and Volksbanks is in our overview of Sparkasse crypto trading.
Move holdings you keep for the long term onto a device of your own; suitable models are listed in the hardware wallet comparison.

(As of November 5, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)

Frequently asked questions about the Crédit Mutuel Arkéa hack

Crédit Mutuel Arkéa confirmed on November 4, 2026 a cyberattack that enabled fraudulent operations. Blockchain investigator ZachXBT links the attack to outflows of more than $133 million via accounts at crypto exchanges.

According to Crédit Mutuel Arkéa, customer assets were not affected. The attack merely delayed the execution of certain transfers, but the bank warns of phishing attempts.

According to ZachXBT, the funds were withdrawn from exchange accounts as USDC and USDT, then swapped into ether, routed through instant exchanges, partly converted into Monero and spread across several blockchains via bridges.

No, statutory deposit protection covers bank balances such as current and overnight accounts, but not crypto assets. For crypto assets, MiCA requires authorised providers to keep client coins separate from their own assets.

Transparency note: This article was produced with the assistance of artificial intelligence and reviewed by our editorial team before publication. All figures and claims were checked against the primary sources linked in the text. The feature image was generated with AI.

Section: All crypto hacks and scams at a glance

Which topics should we dive deeper into?

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

Binance Hack On-Chain Analysis: 50 Signatures, 197,460 ETH and $2.83 Billion Frozen

What really happened in the Binance hack? We analyzed the blockchain ourselves: 50 signatures in one transaction, $2.83 billion frozen, 197,460 ETH with the attacker and an Aave trick. Plus the key voices from X and our conclusion.

August 21, 2026 7:46 AM

Crypto Job Offers Using Your Own Bank Account: How the Money Mule Scheme Works and Why Money Laundering Starts With Negligence

On August 18, 2026 BaFin warned about job offers in which applicants are to pass third-party payments through their own account and exchange them into crypto-assets. Anyone taking part risks criminal proceedings for money laundering, and gross negligence is already enough.

October 31, 2026 12:37 PM

Floin Cyberattack: MiCA Crypto Platform From Liechtenstein Goes Offline

Liechtenstein-based crypto platform Floin reports a cyberattack, remains offline and has now confirmed a data breach. What is known about the MiCA-licensed company, which customer data may be affected and what investors should do now.

March 1, 2026 9:05 AM

Is the Death of Khamenei Good for Crypto? Analyzing Iran’s Shadow Economy

Iran's Supreme Leader Ali Khamenei has been killed. We analyze the 5% Bitcoin bounce and how a crackdown on Iranian money laundering affects the market.

November 3, 2026 3:15 PM

Suspected crypto theft in the EU: Kraken and Crypto.com freeze funds after $133 million outflow

Blockchain investigator ZachXBT is tracing allegedly stolen crypto worth $133 million from an unnamed entity in the EU. Kraken and Crypto.com have frozen linked accounts and funds and say their customers are not at risk.

October 21, 2026 7:16 AM

FinCEN crypto fraud report: what 33,904 filings and $12.7 billion actually show

FinCEN reviewed 33,904 suspicious activity filings covering $12.7 billion in activity. Why the data are a warning signal but not a confirmed loss statement.

October 6, 2026 10:36 PM

Buying Monero in Germany: six major exchanges no longer list XMR

On October 5, 2026, of eight trading venues checked only two still carry an XMR pair, and neither is open to German customers. MiCA Article 76(3) explains the delistings, and Article 79 of the anti-money-laundering regulation sets the tougher limit from July 10, 2027.

October 2, 2026 4:32 AM

NEAR Intents halts withdrawals after a $3.8 million exploit: here are the reasons

NEAR Intents confirms an exploit of more than $3.8 million and holds deposits and withdrawals on eleven networks. Reimbursement is promised, a date for it is not.

September 4, 2026 4:39 AM

Source of Funds at a Crypto Exchange: Why a Deposit Can Freeze Your Account for 15 Days

OKX chief Star Xu described on September 2 what an unusual deposit sets off: reviews of 15 days and longer, during which balances and account functions can be restricted. What that means for investors in Germany, and which documents you should keep to hand.

August 21, 2026 1:26 PM

Crypto Exchange Account Frozen: Why Nobody Tells You Why, and What Actually Helps

If you get no explanation after a freeze, it feels like arbitrary treatment. In fact the German Money Laundering Act forbids the provider from telling you. What happens in that time, which deadlines apply and which documents shorten the process.

November 21, 2023 7:13 PM

BREAKING: Binance CEO Changpeng Zhao to Resign and Plead Guilty

Binance CEO Changpeng Zhao has agreed to step down and plead guilty to criminal charges related to anti-money laundering violations.

June 23, 2019 9:51 PM

FATF: All Global Crypto Exchanges Must Now Share Customer Data

FATF (Financial Action Task Force), an intergovernmental organization whose role is to combat money laundering and terrorism financing has presented their recommendations on regulating cryptocurrencies for its 37 member countries. However, the FATF standards released Friday includes a very controversial […]

September 30, 2026 4:15 PM

Zcash today: 2,746 ZEC from the Bitget hack vanish into the Ironwood pool

Wallets from the Bitget break-in pushed 2,746 ZEC into Zcash's Ironwood pool on Wednesday morning, roughly $3.9 million. What the shielding means for tracing, and what applies to your exchange account from July 2027.

September 22, 2026 7:13 AM

ECB Platform Pontes Goes Live: What to Check on Tokenized Securities Now

The Eurosystem launched its Pontes platform on September 21, 2026, allowing trades in tokenized securities to be settled in central bank money for the first time. Nothing changes in your portfolio today, but the distinction between a crypto-asset and a crypto security will decide tax and liability in future.

September 20, 2026 4:13 AM

Zcash Above $1,500: What ZEC Holders Should Check on Tax and Custody

Zcash rose above $1,500 on September 19 for the first time since 2016 and, after an intraday high of $1,590.80, trades back at around $1,474. For German holders three questions hang on that jump: the one-year holding period, the planned year-end cut-off and the EU anti-money-laundering regulation from July 2027.

August 19, 2026 10:24 AM

Privacy Coins and EU Anti-Money-Laundering Law: An Assessment of the Ban From July 2027

Article 79 of the EU anti-money-laundering regulation bars crypto service providers from keeping accounts that obscure transactions, and it names anonymity-enhancing cryptocurrencies explicitly. This assessment separates the documented wording, including the 10 July 2027 application date, from what follows for individual coins.

August 9, 2022 4:44 PM

US Sanctions Virtual Currency Mixer Tornado Cash: What Will Be The Impact of This Crackdown?

In a major move, the US sanctions Tornado Cash, a virtual currency mixer, after news of money laundering of more than $7 billion.

October 1, 2020 6:37 PM

Bitcoin Dumps As CFTC Indicts BitMEX Founder Arthur Hayes

U.S. prosecutors have filed criminal charges citing four founders and managers of the BitMEX cryptocurrency exchange of neglecting to take adequate steps to prevent money laundering. According to the U.S. Department of Justice and the Commodity Futures Trading Commission (CFTC), […]

November 3, 2026 1:58 AM

Crypto Hack News: Every Attack Since the Binance Hack and How to Stay Safe

Binance, Mercado Bitcoin, BTCPay Server, a WordPress plugin and hijacked WhatsApp accounts: since 29 October hardly a day has passed without a crypto hack. Every case with its status, the loss and the steps that keep you safe now.

May 27, 2024 11:56 AM

Wave of Crypto Hacks and Exploits Hits Influencers and Memecoins: WATCH OUT!

A series of hacks on crypto influencers, celebrities, and a major memecoin exploit have raised serious security concerns within the cryptocurrency community. Here is what you need to watch out for!

June 18, 2025 12:05 PM

BREAKING: Israeli-Linked Hackers Allegedly Wipe Out Nobitex Exchange

Nobitex, Iran’s top crypto exchange, has reportedly lost $48.65 million in a massive hack. Linked to Israeli cyber group Predatory Sparrow, the attack allegedly wiped out 95% of the platform’s assets.

May 2, 2024 7:23 AM

Top 3 Crypto Hacks that Made Millions

The world of cryptos has seen its fair share of hacks, with some resulting in staggering losses. Here are the biggest 3 hacks since 2020.

October 29, 2026 9:54 PM

Biggest Crypto Hack Ever? Binance Joins the List of Exchange Hacks

At about $2.8 billion the suspected Binance hack would be the largest theft a crypto exchange has ever suffered. The biggest crypto hacks at a glance, why exchanges are hit more often, what Tornado Cash has to do with it and what past cases meant for prices.

September 10, 2026 4:15 PM

BW-Bank Opens Bitcoin Trading Inside the Securities Account: What to Check Before Your First Buy

Since September 9, 2026, BW-Bank customers have been able to trade ten crypto assets through their securities account, executed and held in custody by Bitpanda. The familiar securities-account setting hides three points you should settle before your first order.

July 1, 2025 2:12 PM

Germany’s Banking Giants Go Crypto: Deutsche Bank and Sparkassen, the 2026 Launch Status

Deutsche Bank plans crypto custody for institutional clients by the end of 2026, the Sparkassen want to offer crypto trading in their app from mid-October. Where both plans stand.

December 26, 2025 1:50 PM

Breaking: Trust Wallet Chrome Extension Hack Drains $7M, Full Reimbursements Promised

A supply-chain attack hit Trust Wallet’s Chrome extension, draining $7M from users. Binance’s CZ says all victims will be reimbursed.