The Credit Mutuel Arkea cyberattack has raised questions about how quickly a fraud against a traditional bank can reach the crypto market. The French banking group says attackers used its own account to make fraudulent transfers to other banks, and that those transfers may subsequently have enabled cryptocurrency purchases.
The incident itself is confirmed. The complete path of the money, the identity of the attackers and the bank’s final loss are not.
Credit Mutuel Arkea cyberattack: How did attackers get in?
Crédit Mutuel Arkéa says the attackers reached the banking group through the platform of one of its service providers.
In its detailed statement on the incident, the bank rejected reports suggesting that the attackers entered through Fortuneo, its online banking subsidiary. Instead, it said the attackers used the provider’s platform to reach Arkéa directly.
The distinction matters. A service provider can have legitimate connections to a bank’s systems, but Arkéa has not named the provider or explained which access, software or permissions the attackers exploited.
The bank described the incident as a sophisticated external attack and said human error at Arkéa was not the cause. That is the bank’s assessment; its public statement does not provide a detailed technical explanation that would allow outsiders to independently assess the full sequence.
Arkéa says it is working with judicial and law-enforcement authorities to establish the attack’s origin and method.
What was stolen—and where does crypto fit in?
According to Arkéa, the attackers used the bank’s own account to carry out transactions to other banks. They did not use the accounts of customers of its federations or subsidiaries, the bank said.
Arkéa added that those transfers may have enabled the money to be converted into cryptocurrency through specialised platforms.
That wording is important. It does not amount to a confirmation that every euro was converted into crypto, that Arkéa itself held the crypto, or that a cryptocurrency exchange’s systems were hacked.
The bank has also not published a complete transaction-by-transaction account showing how the fraudulent bank transfers connected to specific blockchain wallets.
Why are reports talking about $133 million?
Blockchain investigator ZachXBT identified Crédit Mutuel Arkéa as the suspected victim of a theft he estimated at more than $133 million. CoinDesk reported that the investigator initially put the figure at more than $106 million before identifying further withdrawals.
The bank has not confirmed that precise figure. Asked whether €118 million—reported as approximately $133 million—had been stolen, Arkéa said it could only validate the order of magnitude and was still assessing the financial consequences.
That leaves room for a substantial loss, but not for a definitive final number. The amount initially moved, the amount blocked and the bank’s eventual loss after any recovery may all be different figures.
Arkéa said part of the funds had been blocked and that further recovery work was under way. It did not disclose the value blocked or the amount, if any, already returned.
What did blockchain investigators find?
Blockchain analytics firm Bitquery examined a set of transactions associated with the suspected theft. In its investigation, the firm said approximately $108.8 million in USDC was withdrawn from accounts at Kraken, Crypto(.)com and OKX to 15 wallets over roughly 21 hours on November 1 and 2.
USDC is a dollar-linked stablecoin. Bitquery said much of the money it traced was subsequently swapped into ETH, the native cryptocurrency of Ethereum.
Those findings are useful, but they have limits:
The roughly 21-hour period describes observed crypto withdrawals, not how long attackers had access to the bank’s systems.
Bitquery’s traced amount is not an independently confirmed final loss for Arkéa.
The bank has not publicly confirmed that every transaction in the traced group came from its fraudulent transfers.
The presence of exchange withdrawals does not, by itself, establish that the exchanges were breached or identify the owners of the accounts involved.
CoinDesk reported that Crypto.com said it had blocked funds linked to the incident from moving through its platform. It did not provide a figure for the blocked funds in the statement reported by CoinDesk.
Why does the move into ETH matter?
Some stablecoin issuers have the technical ability to freeze tokens at particular addresses. Native ETH does not have a single issuer with an equivalent freeze switch.
That can make the response more complicated once funds have been swapped. Investigators may still trace transactions, and exchanges may be able to act when funds reach accounts on their platforms. But being able to see funds on a blockchain is not the same as being able to recover them.
Were customers affected?
Arkéa says customers’ assets were not affected and that the incident has no financial consequences for them. It said some customer transfers were delayed.
The group also warned customers to be alert to phishing attempts. Criminals sometimes use news of a security incident to send convincing messages that ask recipients to reveal passwords or other confidential information.
The bank’s warning was precautionary. Its statement did not establish whether customer data had been compromised, so it would be premature to claim either that data was stolen or that a data breach has been ruled out.
Customers who receive an unexpected security message should avoid links in the message and contact the bank through its official app, website or a known phone number.
What has the bank done since the attack?
Arkéa says it activated its crisis procedures after identifying the fraudulent activity. Its response included:
Containing the incident and taking steps to prevent further fraudulent movements.
Temporarily suspending certain transactions as a precaution.
Notifying authorities and supervisory bodies.
Checking systems and strengthening security before operations resumed.
Working to block and recover funds.
The bank said almost all operations resumed during the morning of November 4. That is its latest service-status statement reviewed for this report; it does not establish that every individual transfer or service had returned to normal.
How does this compare with recent crypto hacks?
The Arkéa case is different from a direct attack on a crypto exchange’s wallets.
In the Mercado Bitcoin security incident, the Brazilian exchange confirmed a breach affecting one of its systems and temporarily suspended deposits and withdrawals. Researchers traced crypto assets they linked to that incident, although the exchange did not confirm their estimated total.
Arkéa, by contrast, describes fraudulent transfers from its own bank account, followed by a possible conversion into crypto. There is no public evidence in the disclosures reviewed that the two incidents were carried out by the same attackers.
A similar distinction between tracing and recovery appeared in Bitnxt’s coverage of the Binance hack and its recovery efforts. In that case, frozen assets, funds replaced by the exchange and stolen assets ultimately recovered were separate measures—not interchangeable totals.
Bitnxt’s Take: The weakest link may sit outside the bank
This story is not simply about whether criminals used cryptocurrency. The more revealing question is how an outside platform became a route into a bank’s operations—and what controls existed between that access and the ability to move money.
Banks increasingly depend on technology providers. That can make services faster and more convenient, but it also means security cannot stop at the institution’s own front door. Access permissions, transaction limits, independent approval checks and rapid detection all matter when a third-party connection is involved.
For now, Arkéa’s reassurance to customers is significant. But the public still needs answers about the provider’s role, the actual mechanism, the final loss and the outcome of recovery efforts.
And for crypto readers, there is another lesson: an on-chain trail can reveal where assets went, but it cannot automatically tell us who controlled every account or prove how the original bank fraud occurred.
