{"id":"CMP-202611-rci64b","kind":"campaign","aliases":[],"related":[],"title":"French bank Crédit Mutuel Arkéa reportedly robbed of about $133M (118M+ euros), laundered through crypto exchanges into Monero; bank has not confirmed","description":null,"summary":"Le Télégramme, citing on-chain investigator ZachXBT and a source close to the case, reports that hackers took about $133M (more than 118M euros) in ordinary money (fiat) out of Crédit Mutuel Arkéa. The money was moved through many mule accounts to crypto exchanges including Crypto.com, converted to USDC/USDT, then ETH, and swapped through WellWallet and Kyrrex into Monero. ZachXBT first flagged more than $106M of withdrawals from an 'unidentified European entity' on Sunday 2026-11-01 and raised the figure to $133M on 2026-11-03. Asked for comment, the bank said it was 'not able to confirm at this stage'. ZachXBT rules out North Korea's Lazarus with high confidence. How the attackers got in, the start date, and any effect on customer accounts or data are all unknown.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Crédit Mutuel Arkéa","fixed":[],"vendor":"Crédit Mutuel Arkéa"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Unknown: no attack method or indicators have been published. Crédit Mutuel Arkéa customers (including Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest and Fortuneo, all part of the Arkéa group) should check their accounts for transfers they did not make. Treat any calls, texts or emails that mention this incident and ask for logins, codes or a 'secure transfer' as likely fraud.","fix":"Nothing official yet; the bank has not confirmed the incident. Customers: contact the bank only through its official app or the phone number on your card, never through a link or number in a message. Exchanges and stablecoin issuers: watch for flows tied to ZachXBT's published addresses.","status":"open","published_at":null,"first_seen_at":"2026-11-04T10:23:44+00:00","triaged_at":"2026-11-04T10:23:44+00:00","updated_at":"2026-11-04T10:24:55+00:00","category":"other","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-01':110B '-03':120B '-11':109B,119B '-202611':24A '106m':98B '118m':11A,56B '133m':10A,53B,116B '2026':108B,118B 'abl':130B 'account':74B,159B 'arkéa':5A,28A,66B 'ask':121B 'attack':148B 'bank':2A,19A,125B 'campaign':29B 'case':47B 'chain':38B 'cite':35B 'close':44B 'cmp':23A 'comment':123B 'confid':145B 'confirm':22A,132B 'convert':80B 'crypto':15A,76B 'crypto.com':79B 'crédit':3A,26A,64B 'custom':158B 'data':161B 'date':153B 'earli':31B 'early-warn':30B 'effect':156B 'entiti':105B 'eth':84B 'euro':12A,57B 'european':104B 'exchang':16A,77B 'fiat':61B 'figur':114B 'first':94B 'flag':95B 'french':1A 'got':149B 'hacker':50B 'high':144B 'includ':78B 'investig':39B 'korea':140B 'kyrrex':90B 'launder':13A 'lazarus':142B 'le':33B 'mani':72B 'monero':18A,92B 'money':60B,68B 'move':70B 'mule':73B 'mutuel':4A,27A,65B 'north':139B 'on-chain':36B 'ordinari':59B 'rais':112B 'rci64b':25A 'report':6A,48B 'rob':7A 'rule':137B 'said':126B 'sourc':43B 'stage':135B 'start':152B 'sunday':107B 'swap':86B 'took':51B 'télégramm':34B 'unidentifi':103B 'unknown':164B 'usdc/usdt':82B 'warn':32B 'wellwallet':88B 'withdraw':100B 'zachxbt':40B,93B,136B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["crditmutuelarka","mutuelarka"],"ptokens":["ark","cr","dit","mutuel"],"labels":["campaign","earlywarning","medium","other"],"campaign_type":"breach","first_public_at":"2026-11-04T08:40:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-rci64b","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-04T10:23:44+00:00","fetched_at":"2026-11-04T10:23:44+00:00","note":null}],"documents":[{"id":65989,"url":"https://news.ycombinator.com/item?id=50363333","title":"French bank Crédit Mutuel Arkéa victim of a hack of more than 118M euros","kind":"post","source":"hackernews","publisher":null,"text":"French bank Crédit Mutuel Arkéa victim of a hack of more than 118M euros\nhttps://www.letelegramme.fr/economie/toute-l-actualite/le-credit-mutuel-arkea-victime-dun-piratage-de-plus-de-118-millions-deuros-7151898.php\n\n2 points, 0 comments on Hacker News","published_at":"2026-11-04T09:56:05+00:00","relation":"describes","confidence":null,"note":null},{"id":65998,"url":"https://www.letelegramme.fr/economie/toute-l-actualite/le-credit-mutuel-arkea-victime-dun-piratage-de-plus-de-118-millions-deuros-7151898.php","title":"Le Crédit Mutuel Arkéa victime d'un piratage de plus de 118 millions d'euros","kind":"other","source":"analyst","publisher":null,"text":"On-chain investigator ZachXBT reported withdrawals of more than $106M in USDC/USDT from an unidentified European entity on Sunday, later raised to $133M; journalist's source identifies it as Crédit Mutuel Arkéa: fiat taken out of the bank by hackers, moved through many mule accounts to crypto exchanges including Crypto.com, converted to stablecoins, ETH, swapped via WellWallet and Kyrrex to Monero. Bank: 'not able to confirm at this stage'. ZachXBT rules out Lazarus with high confidence. Over $30M could have been frozen if reported quickly. Attack method unknown.","published_at":"2026-11-04T08:40:24+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}