Crédit Mutuel Arkéa

What happened

On-chain investigator ZachXBT reported that French bank Crédit Mutuel Arkéa (with ~$235 billion in assets) had its centralized exchange accounts compromised in early November 2026, with losses exceeding $133 million (mainly withdrawn as USDC/USDT). Funds were rapidly swapped to ETH, bridged across chains, and laundered into privacy assets like Monero. The bank has not publicly confirmed the incident.

Details

Date

Nov 1, 2026

Kind

Hack or exploit

Method

Account Credentials Stolen

How in

Bridge and cross-chain

Target

not known

Chains

not stated

What would have stopped it all controls for this way in

• Validators or signers are independent operators; no organisation holds enough keys to sign alone.
  Check: The signer set with each operator named; the threshold is above what any one operator controls.
• Every message and proof is checked against the source chain; a message that never happened there is rejected.
  Check: Tests with forged, replayed and empty proofs; the trusted root can never be zero.
• Freeze contacts on both chains are arranged in advance: issuers, exchanges, SEAL 911.
  Check: A contact sheet per chain, confirmed this quarter.

General guidance for this kind of attack, not a finding about this incident.

How sure: 0 of 4 checks what the checks mean

• Witnessesone source so far
• Same storyneeds a second source
• Blockchain receiptno public attack transaction checked
• Official wordno official statement linked

Who says what

• SlowMist Hacked ↗$133M

Figure used: $133M, the figure SlowMist Hacked gives. Each source's own figure is in dollars at the time.

Related incidents