Crédit Mutuel Arkéa has confirmed a cyberattack that reached its own money, but it has not confirmed how much was taken.
The figure comes from ZachXBT, a blockchain fraud investigator. On November 2, he flagged an unnamed EU entity that had lost $106M+ the day before from multiple centralized exchange accounts, withdrawn as USDC and USDT (stablecoins, tokens pegged to the US dollar). A day later he raised the total to $133M+. He wrote that the thief was "aggressively swapping" USDC for ETH, routing funds through instant exchanges, converting some into Monero (a privacy-focused token that is hard to trace), and bridging across chains. He never named the bank.
The bank spoke on November 4. It said it had detected an attack, suspended certain transactions as a precaution, and contained it. A day later, an FAQ said the attackers went through a service provider's platform and reached Arkéa directly, then used the bank's own account to transact with other banks. It would not name the provider, though it ruled out Fortuneo. Asked about the $133 million figure, it said it could "simply validate the order of magnitude."
The bank's framing and the analyst's numbers sit awkwardly together. Customers were unaffected, the bank said, and the incident "only led to a delayed execution of certain transfer operations." That can be true for depositors and still leave a nine-figure hole on the bank's own books.
The timeline also stands out. The theft surfaced on public blockchains, where an outside analyst could see it, before the bank said anything. ZachXBT argued that the lack of disclosure let $30M+ be laundered that EU law enforcement might have frozen. That is his view, and the bank's statements do not address it.
No group has claimed the attack, and ZachXBT does not think North Korea's Lazarus Group was behind it. The open question is which provider's platform gave attackers a path to a bank account.