EN
Español
Português (Brasil)
Türkçe
Tiếng Việt
Bahasa Indonesia
Polski
Čeština
Română
Slovenčina
Magyar5 Nov 2026
French bank Crédit Mutuel Arkéa says attackers used its own account, reached through a supplier's platform, to send fraudulent transfers that may have been converted into crypto. Reported losses of about $133 million are unconfirmed, while Bitquery traced $108.8 million in USDC withdrawals it cannot yet link to the bank.
Exchanges TradeReviewed News Desk
The Crédit Mutuel Arkéa hack is one of the largest attacks on a European bank with a suspected crypto exit route. The Brittany-based French lender said on November 4 that attackers used the bank’s own account to push fraudulent transfers to other banks, money that may then have been converted into cryptocurrency through specialized platforms. Reported losses of about 118 million euros ($133 million) have not been confirmed by the bank, which says it can only validate the order of magnitude.
What Arkéa has confirmed
In a clarification published on November 4, Crédit Mutuel Arkéa set out what it knows so far:
- The attackers reached the bank through the platform of one of its service providers, not through customer accounts.
- The bank denied press reports that the entry point was Fortuneo, its online banking subsidiary.
- The fraudulent transactions came from Arkéa’s own account and were sent to other banking players. The bank says these transfers “potentially” allowed the money to be converted into crypto.
- Customers’ holdings are not affected. The incident only delayed some transfers, and almost all operations had resumed by the morning of November 4.
- The bank called it a sophisticated external attack, not human error, and said it is working with judicial and police authorities to establish the origin and method.
Earlier in the day, Fortuneo users were warned in the app about possible disruption to instant transfers and Wero payments, according to French site MoneyVox. The bank says it suspended some transactions as a precaution while it checked systems and added extra security measures.
How much was taken, and is it gone?
The headline figure of 118 million euros, or $133 million, came from on-chain investigator ZachXBT, who first flagged the fraud, according to Euronews and MoneyVox reporting. Ouest-France reported that ZachXBT identified losses of $106 million coming from several centralized exchange accounts on November 2.
Arkéa has not confirmed any exact number. It said part of the funds had been blocked and that further recovery actions are under way, so the final loss could end up well below the amount moved. The bank also stressed that the sums involved do not threaten its financial health or solidity.
What the blockchain trail shows
Blockchain analytics firm Bitquery reported tracing $108.8 million in USDC withdrawals to 15 addresses on November 1 and 2, as reported by CryptoSlate. The withdrawals came from wallets Bitquery labels as belonging to Kraken, Crypto.com and OKX, and ran for roughly 21 hours, from 12:25 UTC on November 1 to 09:09 UTC on November 2.
Two of those 15 addresses only connect to the suspected theft through intermediate wallets. Excluding them would cut Bitquery’s count to $95.7 million. On November 4, the firm estimated that nearly $42.6 million was still sitting on Ethereum in wallets it associates with the suspected theft, mostly in ETH.
There is an important caveat. Bitquery says it cannot see bank transfers or exchange accounts, so its data cannot prove the route from Arkéa into crypto or identify who controls the receiving addresses. The bank-to-crypto link is the most likely reading of the facts, but it is still unconfirmed.
Why this matters for crypto
This case flips the usual pattern. Most big crypto thefts start on-chain, with a compromised hot wallet or smart contract. Here, the alleged weak point was a traditional bank’s supplier, and crypto exchanges appear only as the possible off-ramp: fiat goes in through bank wires, stablecoins come out to self-custody wallets.
That has a few consequences worth watching:
- Exchange compliance pressure. If investigators confirm that stolen bank money was converted on regulated exchanges, expect questions about how large fresh fiat deposits were screened. Under the EU’s MiCA rules, European crypto platforms already face strict anti-money-laundering checks, and this case could add to calls for faster freezes.
- Stablecoin freezes. Because the funds left as USDC, the issuer can in principle freeze tokens at flagged addresses. Bitquery’s estimate that much of what remains on Ethereum is now in ETH suggests the attackers swapped out of freezable stablecoins quickly.
- A brutal month for security. The incident lands during a heavy run of hacks, including the Binance breach and the attack on Brazil’s largest exchange, which we covered in our report on the Mercado Bitcoin hack.
What it means for traders
There is no sign that Arkéa customers or crypto users lost funds directly, and the bank says client holdings are safe. For traders, the practical lesson is about platform choice and personal security. Large, well-capitalized exchanges with proof of reserves, withdrawal whitelists and strong account protection are better placed to spot and freeze suspicious flows, and to protect you if something goes wrong.
Our crypto exchange comparison ranks platforms on security, fees and regulation, using the method explained in how we test. Our BingX review (our #1 pick) and OKX review (#2) cover proof of reserves, verification and security tools in detail.
What to watch next
- Whether Arkéa publishes a final loss figure after recoveries and blocked funds are counted.
- Whether police or prosecutors confirm the crypto conversion route and the platforms involved.
- Whether more of the traced funds are frozen or move again on Ethereum.
This is not financial advice.
Follow TradeReviewed on X and Telegram: you hear crypto and trading news here first.
Related reviews
Sources
- Crédit Mutuel Arkéa: Informations complémentaires suite à l'attaque dont le Crédit Mutuel Arkéa a été victime
- CryptoSlate: French bank resumes transfers after $133 million attack but leaves crypto loss unconfirmed
- MoneyVox: Crédit Mutuel Arkéa : ce que l'on sait sur l'attaque qui a touché la banque bretonne
- Ouest-France: Plus de 100 millions d'euros dérobés, mode opératoire… Ce que l'on sait après le piratage visant le Crédit Mutuel Arkéa
- Euronews: Crédit Mutuel Arkéa victime d'une cyberattaque : 118 millions d'euros auraient été volés
News is for information only and is not financial advice. More crypto news
You'll hear it here first
Get crypto news first on our Telegram channel.