Crédit Mutuel Arkéa confirmed a cyberattack on November 4, 2026, with losses provisionally estimated at around €100 million. Attackers entered through a third-party vendor's platform, then used the bank's own corporate account to send wire transfers to other banks. According to Bitquery's on-chain investigation, $126.04 million in USDC flowed out of Kraken, Crypto.com, and OKX into 17 wallets, though the full chain of evidence linking those flows to the bank's losses has not been publicly established.
This article draws on the bank's official statement, the AFP dispatch republished by Boursorama, Bitquery's on-chain investigation, Ledger Insights, Cryptoast, exchange statements reported by AMBCrypto, and The Block's MiCA licensing coverage. The post by journalist Grégory Raymond on X is cited as sourced by Bitquery.
The Theft Did Not Happen on the Blockchain
No private keys were stolen. That's the first detail worth pinning down. According to Crédit Mutuel Arkéa's official statement, attackers reached the bank through the platform of an unnamed third-party vendor. They then used the bank's own institutional account, not those of customers belonging to the cooperative federations or its subsidiaries. The bank ruled out human error, describing the attack as sophisticated and externally sourced, and confirmed it has since been contained. No entry point, the bank added, passed through Fortuneo.
According to AFP, Arkéa filed a complaint on Wednesday, November 4, with the cybercrime section of the Paris prosecutor's office. The prosecutor opened an investigation for unauthorized access to a computer system by an organized group, assigning the case to the police's anti-cybercrime unit. The bank stated that the sums involved do not threaten its financial stability: in the first half of 2026, according to AFP, it recorded €230 million in net profit.
The Trail Leads to Regulated Exchange Accounts
The second detail that surprises is the route the attackers chose. According to journalist Grégory Raymond, as cited by Bitquery, the wire transfers landed in exchange accounts opened under false names. Ledger Insights reconstructed the USDC withdrawals of November 1 and 2: $102 million from accounts on Kraken, $5.4 million from Crypto.com, and approximately $660,000 on OKX. A test payment of $1,000 typically preceded each larger transfer, which arrived in tranches of between $5 million and $10 million. Bitquery's total reaches $126.04 million across 17 wallets, with Kraken accounting for roughly 95% of the volume; excluding four indirectly linked wallets, the figure drops to $95.71 million.
Kraken, as reported by Ledger Insights, stated that the incident did not originate on its platform, that it restricted the accounts involved, that it is cooperating with law enforcement, and that no customer accounts were compromised. Crypto.com and OKX, according to AMBCrypto, said they froze related funds and are verifying the case. Kraken operates in the European Union under a MiCA license granted by the Central Bank of Ireland in 2025, according to The Block. The MiCA framework's requirements for crypto-asset service providers are directly relevant here: licensed exchanges are legally obligated to apply know-your-customer controls and cooperate with authorities, which is why the apparent use of false-name accounts raises compliance questions across the sector.
Funds Move Faster Than Press Releases
According to Bitquery, the first withdrawal left OKX at 12:25 UTC on Sunday, November 1. Within roughly three hours, by 23:00 UTC, approximately $73.2 million had exited. Over about four hours, $62.98 million in stablecoins were converted into 27,553 ETH via UniswapX. The funds then split across multiple paths.
Around $36.09 million moved toward LI.FI, including a bridge that converts assets to Monero, whose blockchain trail is not publicly visible. Another $8.14 million ended up at a deposit address linked by blockchain analytics firm TRM to Kyrrex. By 08:47 UTC on November 5, only approximately $37.26 million remained traceable, representing about 30% of the total, according to Bitquery.
The bank's public statement came on November 4, three full days after the first withdrawals Bitquery tracked. On-chain investigator ZachXBT, who had flagged the incident on November 2 without naming the victim, contends that the initial silence allowed over $30 million to be laundered. Cryptoast reports that ZachXBT also assessed, with what he described as a high degree of confidence, that the perpetrators are not linked to Lazarus Group. These are his assessments, not conclusions reached by any law enforcement authority.
Who Froze Funds, and Who Did Not
In the first hours, the most effective brake came from the exchanges, which restricted the accounts involved. On-chain freezes were limited. According to Bitquery, Tether froze approximately $1.14 million in USDT on November 2. By November 5, Circle had not frozen any of the $1.71 million in USDC still sitting in the tracked wallets.
The contrast between the two largest stablecoin issuers on this point is notable. Tether has long maintained and exercised a unilateral freeze capability embedded in its smart contract. Circle's approach to freezing has historically been more reactive to formal law enforcement requests. That difference in protocol has real consequences when funds are moving fast and the investigation is days behind the transaction flow.
The Numbers Still Do Not Add Up
The third paradox is that the victim's figure is lower than what other sources counted. The bank cited approximately €100 million, which according to Bitquery corresponds to roughly $113 million at the exchange rate used by AFP. French newspaper Le Télégramme reported $133 million (approximately €118 million), and Arkéa accepted that order of magnitude without confirming the exact number. ZachXBT started at $106 million and subsequently raised his estimate to over $133 million. Bitquery acknowledges it cannot yet explain the gap between these figures.
What Remains to Be Proven
Quite a lot. The full chain of evidence linking the wire transfers that left the bank to the on-chain flows has not been publicly established: Bitquery does not attribute the 17 wallets to any named actor and bases its connection on press accounts and wallet behavior. The name of the external vendor, the precise date of the intrusion, the method used to open exchange accounts under false identities, the total amount frozen, and the location of any recovered funds all remain undisclosed.
Gaurav Agarwal
The Arkéa Case at a Glance
What is confirmed, and what is not.
- Confirmed: attack via a third-party vendor's platform, wire transfers from the bank's corporate account, provisional loss estimated at around €100 million, customers unaffected, criminal complaint filed and investigation opened in Paris.
- Not disclosed: name of the vendor, exact date of intrusion, final and frozen amounts, public proof linking the bank's losses to the $126.04 million in USDC traced by Bitquery.
- To watch: the Paris prosecutor's investigation, fund recovery efforts, identity checks on the false-name exchange accounts, and any future freeze action by Circle.
The Bigger Picture
This case inverts the familiar narrative around crypto and financial crime. The blockchain didn't fail here. The supply chain of a traditional bank did. Crypto entered the story afterward, as a fast exit route. That distinction matters for how regulators and compliance teams frame the risk. Vendor dependency is already a recognized vulnerability in European finance. The Arkéa incident gives it a concrete price tag.
The second point concerns who actually holds the power to stop funds once they leave the banking system. Exchanges acted first by restricting accounts. On-chain, the response was slower and uneven. Tether froze roughly $1.14 million in USDT by November 2; Circle had frozen none of the $1.71 million in USDC still in tracked wallets as of November 5, according to Bitquery. That asymmetry between the two dominant stablecoin issuers is worth watching as the Paris investigation proceeds, identity verification on the false-name accounts advances, and law enforcement determines how much of the stolen funds can still be recovered.
