Crédit Mutuel Arkéa hack: part of the stolen money is back, says Crédit Mutuel’s head, as Bitquery still saw $37 million on Ethereum on 5 November

Part of the money taken in the Crédit Mutuel Arkéa hack has been recovered. Daniel Baal, president of the Confédération nationale du Crédit Mutuel, said so on France 5 on Friday 6 November, according to AFP, two days after the Brest-based group behind Fortuneo and Keytrade Bank disclosed the attack. He gave no figure for what came back. He put the sum stolen at more than €100 million.

Arkéa says the attackers sent transfers from its own account to other banks, a route that may have let them turn the money into crypto. On-chain, the analytics firm Bitquery counts $126.04 million in USDC leaving Kraken, Crypto.com and OKX on 1 and 2 November, and says $37.26 million was still on Ethereum in addresses it ties to the thief at 08:47 UTC on 5 November. Bitquery names Arkéa as the victim; the bank itself has not linked its loss to those wallets. Nobody has claimed the attack and nobody has been identified.

For customers the bank’s line has not moved since Wednesday. No client account was used, client assets are not affected, and some transfers simply went through late. Still missing: the final loss, the amount recovered, the name of the supplier whose platform was used to get in, and how the euros reached exchange accounts.

Crédit Mutuel Arkéa hack: what the bank has confirmed

Arkéa put out a first statement at 13:00 Paris time on 4 November, then a follow-up answering the questions it had received the same day. The first said the attack had made fraudulent operations possible, that the incident was under control, and that the group had informed “the competent and supervisory bodies” as soon as it was detected (our translation). Some transactions were suspended as a precaution.

The follow-up describes the method. The attackers went through the platform of one of the group’s service providers. They then used Arkéa’s own account, not the client accounts of its federations or subsidiaries, to send transfers to other banks, which may have let them convert the money into crypto on specialised platforms. The group rules out human error and calls it a sophisticated attack from outside. The supplier is not named.

On the amount, the bank stays cautious. Le Télégramme reported $133 million (€118 million); Arkéa does not confirm that figure and says only that it can “validate the order of magnitude” (our translation). Its provisional estimate, AFP reported on the evening of 4 November, is about €100 million. Part of the funds has been blocked and other recovery steps are under way. It is too early for a final amount, the statement says, and the sums do not threaten the group’s solidity or financial health.

The Paris prosecutor’s cybercrime section received a complaint from the group on Wednesday morning and opened an investigation at once, for an attack on an automated data processing system by an organised gang, AFP reported. The case went to the Office anticybercriminalité (OFAC), the French police cybercrime office. Despite the acronym, it has nothing to do with the US Treasury’s sanctions office.

Daniel Baal on 6 November: “part” recovered, origin unknown

Baal chairs the national confederation that oversees the Crédit Mutuel federations, and AFP notes that he also heads Crédit Mutuel Alliance Fédérale. Arkéa, by its own description, is made up of the Crédit Mutuel de Bretagne and Crédit Mutuel du Sud-Ouest federations, their local banks and about forty subsidiaries. On France 5, Baal said Arkéa had recovered “part” of the money and that the amount stolen was more than €100 million.

Asked who was behind it, he could not say: “On this attack, I absolutely cannot say whether it is French or foreign” (our translation). He called the attack very damaging for the bank targeted but said it did not undermine the credibility of the banking system, and that it “must serve as a lesson” for a sector he described as watching closely.

Baal repeated that no individual customer account had been hit. Even if one had been, he said, the bank would have covered the losses, with the deposit guarantee as a further safeguard. Arkéa’s own statements give no recovered amount either, so “part” is all that is public for now.

Two trackers, two totals: ZachXBT’s $133M and Bitquery’s $126M

The crypto side surfaced before the bank spoke. On 2 November the on-chain investigator ZachXBT wrote on his Telegram channel that an EU entity was suspected of losing more than $106 million from several centralized exchange accounts, withdrawn as USDC and USDT. He described the thief “aggressively swapping USDC for ETH”, using instant exchange services, bridging between chains and converting part of the money into Monero through Wagyu.

A day later he raised his count to more than $133 million after finding over $27 million of additional exchange withdrawals, some made after his first post. He blamed the silence: “No proper incident disclosure has resulted in $30M+ being laundered away,” he wrote, arguing that EU law enforcement could have frozen those funds. In a third post he identified the institution as “allegedly” Crédit Mutuel Arkéa, said the attack had run over several days and that the loss may be larger once over-the-counter trades are counted. His figures are his own analysis and have not been confirmed by the bank or the authorities.

Bitquery works from the exchange withdrawals visible on Ethereum. A first version of its work, relayed on 4 November by Bitcoin.com News and IT-Connect, counted about $108.8 million in USDC sent to 15 wallets over about 21 hours. The current version of its investigation, with on-chain figures checked on 5 November, is larger: $126.04 million in USDC from Kraken, Crypto.com and OKX to 17 wallets, over about 28 hours.

The two totals measure different things, so adding them up would double-count. ZachXBT counts USDC and USDT withdrawals he attributes to the thief and expects more from OTC trades. Bitquery counts the USDC payouts it traced from three named exchanges. Neither is the bank’s number, which remains “about €100 million” or, in Baal’s words, more than €100 million.

Where the money went in 28 hours

Bitquery’s timeline starts on Sunday 1 November. The first withdrawal left OKX at 12:25 UTC; Kraken followed 44 minutes later and ended up paying about 95% of the total. The pace picked up in the evening: $73.2 million left in the three hours to 23:00 UTC, and 84% of the money was out by 23:10 UTC. On Monday, Kraken paid $17.2 million to two more wallets between 15:46 and 16:30 UTC, the last payout Bitquery found.

Selling started almost at once. From about 23:44 UTC on Sunday to 04:02 UTC on Monday, one wallet sold $62.98 million of USDC and USDT through UniswapX for 27,553 ETH, about $2,286 per ether. For scale, ether traded near $2,239 at 12:54 UTC on 7 November. Another branch swapped USDC into DAI. Part of the earlier money went through order wallets that the analytics firm TRM tags as Wagyu, a service that swaps into Monero, where the trail stops because that chain hides amounts and addresses. Wagyu was in the news a week earlier, when it confirmed a leak of its Monero swap records.

By 5 November the number of addresses Bitquery links to the thief had grown to 526, from 229 on 2 November. At 08:47 UTC that day $37.26 million was still on Ethereum: 8,926 ETH, 12.27 million DAI, 1.71 million USDC and 1.68 million USDT.

One detail suggests preparation. Twelve of the 17 receiving wallets had already received payouts from the same exchanges before the theft, two of them since May; the oldest first withdrew from Kraken on 4 May. Bitquery concludes that one owner most likely ran them all, which is its own inference.

The entry point: a supplier’s platform, or Fortuneo?

How the euros reached the exchanges is where the accounts diverge. In the bank’s version, the attackers came in through a service provider’s platform and moved money out of Arkéa’s own account by transfers to other banks. Its follow-up statement adds that, contrary to what was said in the press, there was no entry through Fortuneo.

The other version comes from Grégory Raymond, a French journalist who covers digital assets. According to his information, reported by Cryptoast and IT-Connect on 4 November, transfers were issued from Fortuneo to crypto exchange accounts opened under false identities good enough to pass identity checks (KYC). The beneficiary names matched the account holders, which got the transfers past name-matching controls. IT-Connect adds that he spoke of a network of money mules and of Fortuneo’s own funds, not client accounts, being targeted. In Cryptoast’s account, the exchange accounts were created by the fraudsters, not taken over.

The two versions do not cover quite the same ground: the bank talks about where the attackers got in and whose account was debited, Raymond about the path of the transfers. On Fortuneo, though, they clash, and neither side has published documents. Raymond told franceinfo the theft was “a first of its kind” (our translation).

Why Kraken and Crypto.com could freeze, and why most of the money kept moving

Kraken said it had restricted accounts linked to the incident and Crypto.com that it had blocked associated funds, both adding that their own security was not compromised. Those statements were made to Cointelegraph, as relayed by Cryptoast, and neither gave an amount. Coindaro found no statement from OKX. Bitquery cites Raymond’s sources as saying Kraken began freezing funds on the Monday night, which it has not confirmed.

The order of events explains the limits. While coins sit in an exchange account, the exchange holds them and can block them; that is how a centralized exchange’s custody and KYC work. Once they are withdrawn to a wallet the thief controls, the exchange has no reach.

From that point only a stablecoin’s issuer can act. The USDT and USDC contracts let Tether and Circle block an address, one of the practical points covered in our comparison of USDT and USDC. According to Bitquery, Tether froze 1.14 million USDT at 23:10 UTC on 2 November but not another 0.54 million, and Circle has frozen none of the 1.71 million USDC left. Tether uses the same power elsewhere: it blacklisted 32 Tron addresses in late October. Ether and DAI have no issuer able to freeze a balance, and Monero hides it.

That is why the stablecoins were swapped for ETH within hours of leaving the exchanges. ZachXBT’s complaint is about time: the sooner police and platforms are told, the more can be blocked. Whether the bank could have raised the alarm earlier depends on when it spotted the transfers, which it has not said.

What Arkéa, Fortuneo and Keytrade customers should know

According to Arkéa, the incident has “no financial consequence” for its clients and no effect on their assets (our translation). The visible effect was the delayed execution of some transfers; nearly all operations resumed during the morning of 4 November, after checks and stronger security measures. Belgian media reported on 4 November that Keytrade’s parent company was the group hit, and Coindaro found no separate Keytrade statement.

The group has not said client data was stolen. It warns that phishing attempts are possible after the attack and reminds customers never to share their login, password, card number or SMS validation code, and to call their adviser directly to check any message they doubt. A call from a supposed adviser offering to “secure” an account after the hack is a typical lure.

The deposit guarantee Baal mentioned applies when a bank fails, not to a theft from the bank’s own account. For Fortuneo and Keytrade it is run by France’s FGDR and covers up to €100,000 per depositor per credit institution, according to Keytrade’s depositor information sheet. Both are trade names of the same institution, Arkéa Direct Bank, so deposits held under the two brands share a single ceiling.

Supervisors, DORA and the questions still open

Arkéa says it informed the competent and supervisory bodies, without naming them or giving a time. Under the EU’s DORA rules, in force since 17 January 2025, banks must report major ICT incidents to their supervisor; the EU’s reporting standard sets the initial notification within four hours of classifying an incident as major and no later than 24 hours after becoming aware of it. Whether Arkéa met those deadlines is not public, and Coindaro found no statement from the ACPR or the Banque de France. The AMF, which licenses crypto firms, has no role in this bank’s IT.

The open list is long. The final loss and the amount recovered are unknown. So are the supplier’s name, how the attackers got into its platform, and whether the Fortuneo path Raymond described is real. No group has claimed the attack and no suspect has been named by the bank, the prosecutor or the investigators who traced the funds.

The next facts should come from the bank, which says it will report as new information arrives, and from the OFAC investigation. On-chain, the $37.26 million Bitquery saw on Ethereum on 5 November is the part anyone can still watch.