Crédit Mutuel Arkéa: A Bank Fraud With a Crypto Exit

On 4 November 2026, Crédit Mutuel Arkéa, the Brest-based French banking group, confirmed that it had been the victim of a cyberattack that "allowed fraudulent transactions". By the bank's own account, attackers used its own account to send money to other banks, and those funds may then have been converted into cryptocurrency on specialised platforms. The bank says the incident is contained and that customer holdings are not affected. It has not published a loss figure.

What the bank has confirmed#

Arkéa issued a press release and, later the same day, a Q&A. The main points:

• Entry point: the attackers "went through the platform of one of our service providers" and reached the group directly. The bank denies press reports that the entry was through Fortuneo, its online bank.
• Accounts used: the bank's own account, not customer accounts of its federations or subsidiaries.
• Cause: "a sophisticated attack from the outside"; the bank rules out human error at Arkéa.
• Impact on customers: none on their holdings; some transfers were delayed while certain transactions were suspended as a precaution. Almost all operations had resumed by the morning of 4 November.
• Amount: asked about the reported €118 million ($133 million), the bank said it "does not confirm" the figure and "can only validate the order of magnitude". Part of the funds has been blocked and recovery efforts are under way.

The Paris prosecutor's office told AFP it received a complaint from the group on 4 November and opened an investigation into an attack on an automated data processing system by an organised group, handled by France's anti-cybercrime office.

The crypto side#

The incident became public through on-chain investigator ZachXBT, who flagged a theft of more than $106 million from an unnamed EU entity on 2 November, later raised the estimate to more than $133 million and named Arkéa. He said he was highly confident the attacker was not North Korea's Lazarus Group.

Blockchain analytics firm Bitquery has published the most detailed trace so far. It counts $108.8 million in USDC withdrawn from Kraken, Crypto.com and OKX to 15 Ethereum wallets between 12:25 UTC on 1 November and 09:09 UTC on 2 November. Eleven of those wallets had received payouts from the same exchanges before, the oldest since May. Within hours, a fresh wallet sold about $63 million of USDC and USDT for 27,553 ETH through UniswapX. At 09:49 UTC on 4 November, Bitquery saw about $42.6 million still on Ethereum in addresses it ties to the thief, mostly as ETH, while around $70.9 million had moved on through bridges, exchange deposits, instant swap services and a route into Monero. Tether had frozen 1.14 million USDT. Bitquery found no USDC frozen by Circle at that point.

Crypto.com told CoinDesk it had blocked funds linked to the incident, and OKX said it froze an institutional customer account after detecting unusual activity. Bitquery notes that Kraken and Crypto.com have said their platforms remained secure.

Bitquery is explicit about its limits: it cannot see bank transfers or exchange accounts, so the chain alone does not prove the route from Arkéa into crypto, nor who controlled the receiving wallets. Its trace was also published before the bank's Q&A, which contradicts the Fortuneo account Bitquery cited.

Our view#

As XDRIP Digital Management LLC, we read this as a banking incident with a crypto exit, not a failure of a blockchain or of an exchange's wallet security. Nothing published so far points to a compromise of Kraken, Crypto.com or OKX.

Two points stand out. First, the weak link named by the bank is a third-party provider's platform. Access through suppliers remains one of the hardest risks for any financial institution to control. Second, the speed of the conversion matters. Stablecoins can be frozen by their issuers. ETH, DAI and Monero cannot. Bitquery's timeline shows the swap into ETH starting within hours. Freezes only help when the request arrives before the swap.

Still open: the identity of the provider, how its platform was abused, the final loss after blocked funds and recoveries, and whether the exchange accounts were opened in advance under false identities.

Sources#

• Crédit Mutuel Arkéa, press release (4 Nov 2026, FR): https://www.cm-arkea.com/arkea/banque/upload/docs/application/pdf/2026-11/04112026_-_communique_-_le_credit_mutuel_arkea_annonce_avoir_ete_victime_dune_cyberattaque_.pdf
• Crédit Mutuel Arkéa, additional information / Q&A (4 Nov 2026, FR): https://www.cm-arkea.com/arkea/banque/assurances/pa_38386/fr/informations-complementaires-suite-a-l-attaque-dont-le-credit-mutuel-arkea-a-ete-victime
• AFP (4 Nov 2026): https://www.afp.com/en/french-bank-says-cyberattack-stole-around-100-mn
• France 24 / AFP (4 Nov 2026, FR): https://www.france24.com/fr/info-en-continu/20261104-cr%C3%A9dit-mutuel-ark%C3%A9a-victime-d-une-cyberattaque-ayant-permis-des-op%C3%A9rations-frauduleuses
• Bitquery, on-chain investigation (figures as of 4 Nov 2026): https://bitquery.io/investigations/eu-106m-crypto-theft
• CoinDesk (updated 4 Nov 2026): https://www.coindesk.com/business/2026/11/04/zachxbt-names-french-bank-credit-mutuel-arkea-as-suspected-victim-of-usd133-million-crypto-theft
• CryptoSlate (5 Nov 2026): https://cryptoslate.com/french-bank-resumes-transfers-after-133-million-attack-but-leaves-crypto-loss-unconfirmed/