French banking group Crédit Mutuel Arkéa confirms it suffers a cyberattack, as blockchain investigator ZachXBT links the incident to a multi-day crypto drain worth more than $133 million.
ZachXBT identifies the Brittany-based lender as the likely victim after tracking suspicious withdrawals from centralized exchange accounts over several days, and he warns the true total could be higher.
He puts the group’s assets at around $235 billion, which would make this one of the larger crypto thefts to hit a traditional bank.
Blockchain analytics show funds leaving accounts at Kraken, Crypto.com and OKX, then being converted and moved onward within hours rather than sitting idle.
Roughly $63 million in stablecoins is swapped into Ether in just four hours. Another tracker reports a single address spending 65.6 million USDT to buy about 28,600 ETH.
Further tracing suggests an additional $27 million surfaces later, pushing ZachXBT’s estimate past $133 million and leaving open the question of over-the-counter activity.
Kraken limits accounts connected to the suspected theft while Crypto.com blocks linked funds, and both exchanges stress that the security of their own platforms remains intact.
The bank itself confirms an attack and says it contains the incident, then begins restoring services after temporarily suspending some transfers.
Arkéa insists customer assets are not affected, though some payments are delayed, and it says its financial strength will not be undermined by the event.
The group does not confirm the $133 million figure. French media cite a local estimate near 118 million euros, which converts to roughly the same amount in dollars.
Headquartered in Brest, the group includes Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest and the online bank Fortuneo, which several French outlets name in their coverage.
It remains unclear how the attackers gain access. Whether the weakness sits in the bank’s own systems, its exchange relationships or its credentials is not yet established.
That uncertainty matters because the stolen assets sit in exchange accounts rather than customer wallets, which draws attention to account security and treasury controls.
Banks have expanded crypto services steadily, from custody and trading to treasury exposure, and every new link to an exchange adds another place where an attack can land.
The incident arrives at a tense moment for the sector. Recent exchange hacks this year have already pushed security back to the top of the industry’s agenda.
Investigators will track whether the Ether bought in the drain moves through mixers or cross-chain bridges, a common route for stolen funds trying to disappear.
Exchanges play a central role in any recovery. Fast freezes at the point of cash-out are often the best chance of clawing back a share of stolen assets.
Early action from Kraken and Crypto.com shows how quickly compliance teams respond once an investigator flags a case, though funds already converted and moved are far harder to retrieve.
It remains to be seen whether French supervisors will request a full account of the breach and the safeguards the bank had in place.
The final loss figure may change. Over-the-counter transactions, additional wallets and the bank’s own accounting could all alter the total once the investigation matures.
For the wider market, the case is a reminder that institutional adoption brings institutional-sized targets, and attackers follow the money wherever large balances sit.
More updates are expected from Arkéa, the exchanges involved and onchain investigators as they trace where the stolen assets end up.
