Reports put a cyberattack on French banking group Crédit Mutuel Arkéa at roughly €118 million ($133 million), though that is not a confirmed final loss. Separately reported blockchain activity has not been linked to the bank: tracing where crypto moved does not prove who owned it.
- The reported transfers came from an Arkéa account, not customer accounts.
- The bank reportedly traced the intrusion to an unnamed service provider, not Fortuneo.
- ZachXBT and Bitquery described crypto flows, but their connection to Arkéa remains unverified.
- Some funds were reportedly blocked; the amount recovered is unknown.
What is known about the reported attack
Arkéa’s disclosure was reported on November 4. According to reports, the bank said attackers accessed the group through an unnamed third-party service provider and used an Arkéa account to make unauthorized transfers. It also reportedly rejected claims that Fortuneo, its online banking subsidiary, was the entry point.
Reports have not identified the provider, the weakness exploited or the precise route into the bank. Arkéa was described as calling the incident a “sophisticated attack from outside” and saying its security teams had contained it.
Reports put the amount involved at €118 million ($133 million). Arkéa was quoted as saying:
“We do not confirm this information and can only validate the order of magnitude.”
The amount transferred, the amount blocked or recovered, and the bank’s eventual loss are three different figures. Available reporting does not establish any of them precisely.
Arkéa reportedly said the transfers did not come from customer accounts and that customer assets were unaffected. Some funds were said to have been blocked, but reports identified neither the amount nor the institution that blocked them. A block can stop money from moving without returning it to the bank, so it should not be counted as a recovery.
Reports said some transactions were temporarily suspended, delaying customers, before services gradually resumed on November 4. They do not specify which transactions or services were affected. The bank also reportedly warned customers about possible phishing attempts and advised them not to disclose passwords, account identifiers, card numbers or SMS verification codes. No confirmed customer-data theft was reported. That does not establish whether any data or credentials were accessed.
What the crypto tracing does and does not show
Before Arkéa’s reported disclosure, blockchain investigator ZachXBT posted about suspicious withdrawals from an unnamed European entity. BeInCrypto reported his findings, along with analysis attributed to blockchain analytics firm Bitquery. Later reports linked the activity to Arkéa, but public transaction data alone does not show that the funds belonged to the bank.
According to BeInCrypto, ZachXBT first flagged the suspected activity on November 2, describing more than $106 million in withdrawals from several centralized exchange accounts. He reported further withdrawals the next day. Bitquery reportedly traced $108.8 million in USDC associated with the suspected theft, withdrawn from Kraken, Crypto.com and OKX over about 21 hours on November 1 and 2.
Bitquery also reportedly tracked $62.98 million in stablecoins converted into 27, 553 ETH in roughly four hours. These figures describe reported activity at different stages. They are not a confirmed tally of Arkéa’s loss and should not be added together. Available accounts do not reconcile them with the €118 million ($133 million) estimate.
ZachXBT separately alleged that more than $30 million had been laundered away and could have been frozen. The report does not say whether that amount overlaps with the other figures, whether a freeze occurred, who may have imposed it, or whether any funds were returned.
USDC and USDT are stablecoins designed to track the value of the U.S. dollar. ETH is the native asset of the Ethereum network. Public blockchains make many transfers visible, but a transaction record alone does not identify who controlled a wallet or prove that the money came from a particular bank. Establishing ownership typically requires evidence beyond the on-chain trail.
Investigation and unanswered questions
AFP separately reported that the Paris public prosecutor’s office had opened an investigation into an alleged attack on an automated data-processing system by an organized group. The reports provide no technical findings or details about suspects.
Arkéa reportedly said it was cooperating with authorities. Investigators will need to establish how the attackers gained access, how much money moved and whether the crypto transactions identified by ZachXBT and Bitquery were connected to the bank.
Key questions
-
Is $133 million Arkéa’s confirmed loss?
No. It is a reported estimate. Arkéa was quoted as confirming only the approximate scale, not the exact amount or final loss.
-
Have the crypto flows been linked to Arkéa?
Not in available public reporting. ZachXBT and Bitquery described suspicious transactions, but that does not independently prove the funds belonged to the bank.
-
Were funds recovered?
Some were reportedly blocked, but no amount was disclosed. Reports do not establish how much, if any, was returned to Arkéa.
-
What remains unknown?
The service provider’s identity, the attack method, the final loss and the ownership of the wallets involved in the reported crypto flows remain unresolved.
For now, the public record supports a narrower conclusion than the headline figures suggest: Arkéa was reported to have suffered a serious attack, while investigators and analysts described substantial suspicious crypto movements. No public evidence has established a link between those movements and the bank. On-chain tracing can show where tokens went, but proving whose money they were takes more than a blockchain explorer. Related ZachXBT investigations into crypto markets and alleged crypto fraud also show why tracing activity is only one part of establishing what happened.
