Crédit Mutuel Arkéa: what is established, and what is not

What the bank confirms

Crédit Mutuel Arkéa acknowledged on 4 November that it had been the target of a cyberattack enabling fraudulent operations. The group validates the order of magnitude of 100 million euros reported in the press, without settling a final figure¹.

The attackers used an account belonging to the group itself to make transfers to other institutions. Customer accounts were not used to move the diverted funds, no client balance was debited, and holdings suffer no financial consequence. Some transfers were delayed, with nearly all operations resuming the same morning².

The bank places the point of entry on the platform of a service provider it does not name, rules out an intrusion through Fortuneo, and excludes human error. Part of the funds has been blocked. The Paris prosecutor has opened an investigation into interference with an automated data processing system by an organised group, assigned to France's anti-cybercrime office, and the Banque de France has been informed¹.

What on-chain analysis shows

The story broke before the statement. The on-chain investigator ZachXBT flagged the movements as early as 2 November, before naming the bank publicly on the 4th. He puts the figure at more than 133 million dollars, after an initial estimate of 106 million to which a further 27 million in withdrawals was added, and says the total could rise if over-the-counter trades are included³.

The analysis firm Bitquery traced 108.8 million dollars in USDC leaving Kraken, Crypto.com and OKX over twenty-one hours on 1 and 2 November, towards some fifteen wallets. Most of it was converted into ether, including nearly 63 million dollars in a single night³.

Two exchanges have responded publicly: Crypto.com says it blocked funds linked to the incident, and OKX says it froze an institutional customer account tied to the attack. Kraken did not respond to requests for comment. ZachXBT also says he rules out North Korea's Lazarus Group with a high degree of confidence, the movement of funds not matching its habits³.

What is not established

It would be tempting to set the two accounts against each other. They in fact describe two distinct stages of the same chain, and the junction between them is missing.

The bank explains how the money left its systems. On-chain analysis observes withdrawals from accounts held on exchanges, and ZachXBT states that investigators have not determined how the attacker reached those accounts³. Nothing public yet links the bank transfers precisely to the traced wallets.

The only head-on disagreement concerns Fortuneo: press reports name it as the target, the bank denies it. No public evidence settles the question.

One useful clarification on freezing. Stablecoin issuers can block their own tokens, and exchanges can freeze holdings that arrive in accounts they control. Ether offers no such mechanism, and passing through a privacy asset makes public tracing considerably harder without making it impossible. The window for intervention is measured in hours: less than two days passed between the first withdrawal and the conversion of most of the funds.

Three things will allow a judgement: the identity of the service provider and the vector used, the final amount once recoveries are settled, and the share of funds actually frozen. None is available at this stage.

Position as at 4 November 2026.

Sources & notes

1. AFP, via Boursorama, "Crédit Mutuel Arkéa : cyberattaque pour près de 100 millions d'euros, enquête ouverte", 4 November 2026 (in French), https://www.boursorama.com/actualite-economique/actualites/credit-mutuel-arkea-victime-d-une-cyberattaque-qui-a-permis-des-operations-frauduleuses-7a25b65f08450c07e9ea616dca1bfc71 ↩ ↩²

2. MeNow, "Cyberattaque chez Arkéa : la banque précise quels comptes ont été touchés", 4 November 2026 (in French), https://www.menow.fr/cyberattaque-arkea-comptes-banque-fortuneo-precisions/ ↩

3. CoinDesk, "ZachXBT names French bank Crédit Mutuel Arkéa in $133M crypto exchange theft", 4 November 2026, https://www.coindesk.com/business/2026/11/04/zachxbt-names-french-bank-credit-mutuel-arkea-as-suspected-victim-of-usd133-million-crypto-theft ↩ ↩² ↩³ ↩⁴