What Crédit Mutuel Arkéa has confirmed
Crédit Mutuel Arkéa confirmed on November 4, 2026, that it had been hit by an attack that enabled fraudulent transactions, marking a significant security incident for one of France’s major regional banking groups . In its public statement, the bank said the incident was “closed” and “under control,” and that operations were being progressively restored after additional checks and reinforced security measures .
The bank said it had temporarily suspended some transactions as a precaution, with the stated aim of securing operations and preventing further fraudulent movements . That suspension appears to have affected some transfers rather than ordinary customer balances: Arkéa said the incident had only caused delayed execution of certain transfer operations and had no impact on customer assets .
The group also said it had notified competent and supervisory authorities after detecting the attack, in line with its procedures . It did not disclose the technical path used by the attackers, the identity of any suspected perpetrators, or a final amount linked to the fraudulent transactions .
The most important point for customers is the bank’s assurance that their interests are fully protected . Arkéa said the amounts affected were still being evaluated but were not, in any event, of a scale that would call into question the group’s financial solidity or health . That is a carefully worded statement: it reassures clients about their deposits and the bank’s stability, while leaving open the operational and investigative questions at the center of the case.
The reported $133 million figure
The $133 million figure comes from outside the bank, not from Arkéa itself. AFP reported that the bank had not confirmed the reported loss, which media accounts linked to independent blockchain investigator ZachXBT and which was widely cited as approximately $133 million, or about €118 million . Euronews also reported that the bank had not confirmed the $133 million figure, while noting that the amount involved was still being assessed .
CoinDesk reported that ZachXBT first flagged suspected losses above $106 million and later identified another $27 million in withdrawals from centralized crypto exchanges, lifting the estimate above $133 million . The same report said ZachXBT believed the total could be higher if over-the-counter transactions are included . That distinction matters because blockchain-visible movements may show only part of a broader cash-out or laundering route.
The Block, reporting before Arkéa’s public confirmation, said ZachXBT had identified Crédit Mutuel Arkéa as the alleged victim of a theft estimated at more than $133 million and had described the incident as spanning multiple days . It also reported his assessment that the attacker was likely not connected to North Korea’s Lazarus Group, based on differences in how the funds moved .
At this stage, the safest formulation is therefore precise: Arkéa has confirmed an attack and fraudulent transactions; several reports and blockchain investigators have alleged losses exceeding $133 million; the bank has not confirmed that amount.
How the funds were allegedly moved
The alleged laundering pattern points to the increasingly blurred boundary between traditional banking fraud and crypto-asset infrastructure. CoinDesk reported that blockchain analytics firm Bitquery traced $108.8 million in USDC withdrawals from accounts at Kraken, Crypto.com, and OKX over roughly 21 hours on November 1 and 2 . Bitquery reportedly traced the funds through hundreds of wallets, with much of the money converted into ether, which does not have a central issuer able to freeze tokens in the way a stablecoin issuer may be able to do .
CoinDesk also reported that Crypto.com said it had blocked funds linked to the incident and that customer funds on its platform remained secure and accessible . OKX told CoinDesk it had identified unusual activity involving an institutional customer account, frozen the account, and contacted the client, while saying there was no indication of a wider impact on other customer accounts . Kraken did not immediately respond to CoinDesk’s request for comment in that report .
Anadolu reported that ZachXBT alleged hackers had laundered more than $30 million before authorities were alerted, but it also emphasized that the reported scale of the theft could not be independently verified . That caveat is central: blockchain tracing can show flows, wallets, conversions, and exchange touchpoints, but attributing those flows to a specific institutional loss requires information that is often held by banks, exchanges, law enforcement, and supervisors.
The Block reported that the suspected funds were withdrawn as USDC and USDT, then swapped into ether, sent to instant exchanges, converted in part into Monero, and bridged across multiple chains . If accurate, that route would be consistent with a strategy designed to move quickly from assets that may be easier to freeze into assets and networks that are harder to trace or recover .
What remains unknown
The attack leaves several unanswered questions. Arkéa has not explained how the attackers were able to trigger fraudulent operations, whether the weakness involved bank payment systems, compromised credentials, an internal process failure, a third-party service, or some combination of those factors . The bank has also not confirmed whether any stolen or attempted funds originated as fiat currency, crypto assets, corporate treasury funds, customer-related funds, or exchange-account balances .
The timing also remains important. Reports from crypto investigators point to suspicious withdrawals on November 1 and 2, while Arkéa publicly confirmed the attack on November 4 . Arkéa said that, once the attack was detected, it contacted the relevant authorities and suspended certain transactions to prevent further movements . Investigators and market observers will now focus on the gap between the first alleged flows, the detection of the incident, the freezing of any assets, and the public confirmation.
A further uncertainty concerns recovery. Euronews reported that Arkéa told another French newspaper that some funds had been frozen and that the amount involved was still being assessed . That suggests the final loss may depend on what was blocked at exchanges, what was frozen by issuers or authorities, and what had already been converted into harder-to-seize assets.
Why this case matters beyond one bank
This incident matters because it appears to sit at the intersection of regulated banking, centralized crypto exchanges, stablecoins, and rapid cross-chain laundering. Arkéa is a conventional French banking group, yet the reported flows moved through crypto exchange accounts and stablecoin rails, according to CoinDesk and Bitquery’s analysis as reported by CoinDesk . That makes the case a warning for financial institutions that do not necessarily see themselves as crypto-native but may still be exposed to crypto-enabled laundering routes after a breach or fraud.
It is also a test of incident response. Arkéa says it suspended certain transactions, implemented reinforced security measures, and is restoring operations progressively . Exchanges named in reporting say at least some funds or accounts were blocked or frozen . The question for investigators will be whether that response was fast enough to reduce the loss and whether earlier detection could have kept more value inside freezeable channels.
For customers, the immediate message is narrower. Arkéa says customer assets are not affected and that delayed transfers are being processed as operations resume . It also warned that phishing attempts may follow the attack and told clients not to share identifiers, passwords, card numbers, or SMS validation codes . That warning is practical: major cyber incidents often generate copycat scams in which criminals impersonate the affected institution and pressure customers to “secure” their accounts by handing over credentials.
A controlled incident, but not a closed story
Crédit Mutuel Arkéa’s statement is designed to draw a line under the immediate operational emergency: the incident is under control, transfers are resuming, customer assets are protected, and the bank’s financial health is not in question . But the public record does not yet close the case.
The size of the reported theft remains unconfirmed by the bank . The attack vector remains undisclosed . The amount recovered or frozen remains unclear . The relationship between the suspected on-chain flows and the bank’s own internal loss assessment remains to be established . Until Arkéa, regulators, law enforcement, or exchange partners provide more detail, the incident should be treated as a confirmed cyberattack with alleged losses above $133 million, not as a fully quantified theft.
What is already clear is that the episode has placed a French banking group at the center of one of the most closely watched financial cyber incidents of the week. It shows how quickly a bank fraud investigation can become a blockchain-tracing case, and how customer reassurance, regulatory notification, exchange cooperation, and public transparency now have to move on the same clock .