French Bank Arkéa Says Hackers Used a Supplier to Move Funds Toward Crypto
Coinvote tarafından
Crédit Mutuel Arkéa says a supplier's platform let attackers send money from its own account to other banks, and that customer assets were untouched. Onchain investigator ZachXBT estimates the crypto-linked losses at more than $133 million, a total the bank has not confirmed.
Arkéa restarts services after a supplier-linked breach
Crédit Mutuel Arkéa said on Wednesday that nearly all of its operations had resumed after a cyberattack, Cointelegraph reported. In a statement shared with Decrypt, the French banking group called the incident closed and under control. It said services were returning gradually after stronger security measures were put in place, according to Decrypt.
The bank says customers' holdings were not touched and that the disruption merely postponed certain transfers. It suspended certain transactions as a precaution and warned customers to expect phishing attempts, Bitcoin Magazine reported.
On the mechanism, the bank said the attackers got in via a platform run by one of its service providers and from there gained direct access to the bank. The bank said they then sent transfers to other banks from its own account. That route could potentially have let them convert the money into cryptocurrency through specialised platforms, according to Bitcoin Magazine.
How the money surfaced onchain
The suspected theft first became visible through exchange withdrawals. Before any victim was identified, analytics firm Bitquery followed outflows from Kraken, Crypto.com and OKX accounts, Cointelegraph reported.
ZachXBT flagged the activity on Monday without naming the victim. He wrote that an entity in the European Union was suspected of losing more than $106 million from several exchange accounts on Nov. 1, with the funds taken out as USDC and USDT. According to Decrypt, the attacker then swapped USDC for ETH, used instant exchanges, converted some funds into the privacy coin Monero and bridged assets across several chains.
On Tuesday he added another $27 million in exchange withdrawals, bringing his total above $133 million. Decrypt noted that some of those withdrawals happened after his first post, and that he published four Ethereum addresses he linked to the theft. He also wrote that the intrusion lasted several days and that he suspects over-the-counter activity could push the true total higher.
The figures that define the case
The numbers below come from different parties, and only the bank's own statements reflect its position.
- More than $106 million: ZachXBT's first estimate of withdrawals from exchange accounts on Nov. 1.
- More than $133 million: his updated total after finding a further $27 million.
- About 100 million euros: the bank's provisional estimate, as reported by AFP and cited by Bitcoin Magazine.
- 118 million euros, or $133 million: the figure the bank was asked about. It said it could only validate the order of magnitude.
- About $30 million: the amount ZachXBT said law enforcement could have frozen had the incident been disclosed properly.
Where the outlets agree and where they differ
All four outlets agree that the bank confirmed a cyberattack and has not endorsed a precise loss. The Block summarised the position this way: the bank accepted that the $133 million estimate is of the right scale but did not confirm the precise sum. Bitcoin Magazine added that Reuters reported the bank saying its losses were lower than $133 million, and that a spokesperson called it too early for a final number.
Smaller discrepancies remain. Cointelegraph says ZachXBT's Wednesday report identified Arkéa, while Decrypt quotes a Tuesday Telegram post naming the bank. Decrypt gives the bank's assets as $235 billion, per ZachXBT, whereas Bitcoin Magazine cites Reuters for 211.5 billion euros, about $238 billion.
Bitcoin Magazine and Cointelegraph also report that the bank denied French press accounts that the intrusion came through Fortuneo, its online banking arm. Bitcoin Magazine says the bank described a sophisticated external attack rather than human error.
On disclosure, the accounts conflict. Decrypt reports ZachXBT's theory that the incident was being covered up, while the bank says it informed its regulators immediately after detecting the attack.
Why a bank's crypto trail matters
Cash that leaves a bank through ordinary transfers normally stays inside regulated rails. Here, the reported path ended at crypto exchanges, where stablecoins can be swapped and bridged within minutes. Instant exchanges and privacy coins add friction for anyone trying to follow or freeze funds.
Exchanges did act in part. Cointelegraph reported that Kraken and Crypto.com had earlier told it they limited certain accounts or held back funds tied to the suspected theft. Each exchange said its platform remained secure. The bank also said part of the funds has been frozen and that other recovery steps are underway.
The episode also touches the bank's own plans. Decrypt cited L'Agefi as reporting in May that the group had filed an application under MiCA, the European Union's crypto regulatory framework, to provide crypto services to its retail clients. The bank has not linked that application to the attack.
The case lands days after the Binance hack, which Bitcoin Magazine put at a record $6.34 billion. Decrypt says the FBI attributed it to North Korean hackers. ZachXBT said he was highly confident the Arkéa attacker was not the Lazarus Group. Bitcoin Magazine also noted that Brazil's Mercado Bitcoin suspended customer deposits and withdrawals this week following a separate security incident.
Open questions to watch
The final loss is the first unknown. The bank has said the sums involved do not endanger its financial soundness, but it has not published a figure. Whether its provisional estimate holds, and whether over-the-counter activity raises ZachXBT's tally, will shape the picture.
Recovery is the second. The bank says some funds are frozen, but it has not said how much. Bitcoin Magazine notes that the bank has not disclosed the start date of the attack, the identity of the perpetrators, or whether any data was stolen. It is working with judicial and police authorities on the origin.
Readers tracking the story can also watch for details on the supplier involved and any regulatory response. Decrypt noted that ZachXBT did not explain how he identified the bank or how the attacker obtained access to the exchange accounts.
Market snapshot
| Asset | Price | 24h | 7d | Market cap |
|---|---|---|---|---|
| Bitcoin (BTC) | $77,471 | -4.2% | -2.5% | $1.56 trillion |
| Ethereum (ETH) | $2,305 | -5.4% | +0.7% | $281.59 billion |
| Monero (XMR) | $628 | -2.6% | +5.1% | $11.82 billion |
CoinGecko data as of 2026-11-05 (UTC).
FAQ
How much did Crédit Mutuel Arkéa lose in the cyberattack?
The bank has not given a final figure. ZachXBT puts suspected crypto-linked withdrawals above $133 million, and the bank said it could only validate the order of magnitude. AFP reported a provisional estimate of about 100 million euros.
How did attackers reach Crédit Mutuel Arkéa?
The bank said the attackers came in via a service provider's platform and then sent transfers to other banks from the bank's own account. It denied press reports that Fortuneo was the entry point.
Were Arkéa customers' funds affected?
The bank says customers lost no assets and that the incident caused delays to some transfers. It also warned customers to be alert to phishing attempts.
Sources
- Cointelegraph: Crédit Mutuel Arkéa resumes operations after attack, assesses losses (2026-11-05)
- The Block: Crédit Mutuel Arkéa confirms cyberattack after ZachXBT flags $133M in suspected losses (2026-11-05)
- Bitcoin Magazine: French Bank Credit Mutuel Arkea Confirms Cyberattack as ZachXBT Puts Losses Above $133 Million (2026-11-04)
- Decrypt: ZachXBT Names French Bank Crédit Mutuel Arkéa as Alleged Victim of $133M Crypto Theft (2026-11-04)
- CoinGecko (market data)
Written by the Coinvote news desk from reporting by Cointelegraph, The Block, Bitcoin Magazine and Decrypt. Not financial advice.
