Arkéa Breaks Silence on $133M Crypto Hack Revealed by ZachXBT

Key Highlights:

• Crédit Mutuel Arkéa confirmed a cyberattack tied to a crypto hack that ZachXBT traced to more than $133 million.
• Attackers got in through a service provider’s platform and used Arkéa’s own account to send transfers.
• Arkéa says customer assets were not affected, and a Paris cybercrime investigation is open.

Crédit Mutuel Arkéa has confirmed it was hit by a cyberattack, days after blockchain investigator ZachXBT named the French bank as the suspected victim of a crypto hack worth more than $133 million.

The bank says customer money is safe, but it has not signed off on the $133 million figure, and its account of the crypto hack differs from early reports.

Attackers got into Arkéa through an outside provider, moved money out of the bank’s own account and then turned much of it into digital assets.

How Hackers Used a Third-Party Provider to Access Crédit Mutuel Arkéa

Early coverage suggested the attackers came in through Fortuneo, Arkéa’s online banking subsidiary. The bank has rejected that.

In a Q&A statement, Arkéa said the attackers went through the platform of one of its service providers, which gave them a direct path into Crédit Mutuel Arkéa.

From there, they used an account belonging to the bank itself to send transfers to other banks. Customer accounts at its federations and subsidiaries were not touched. Arkéa has not named the provider.

The bank also pushed back on any suggestion of an internal slip. It called the incident “a sophisticated attack from outside, which has now been contained,” and said its security systems flagged the suspicious activity quickly.

That detail changes how this crypto hack should be read. The money was not sitting in a wallet when it was taken. It left the bank as ordinary transfers and only entered the crypto sector later.

Crédit Mutuel Arkéa Investigates Reported $133M Crypto Hack

Two numbers are now in circulation. ZachXBT first flagged more than $106 million in suspicious withdrawals. He then traced about $27 million more, which puts his total estimate above $133 million.

Blockchain analytics firm Bitquery separately tracked about $108.8 million in USDC withdrawn over roughly 21 hours on November 1 and 2.

Arkéa’s position is more guarded. Asked whether €118 million ($133 million) was stolen, the bank said it does not confirm the figure and can only validate the order of magnitude. R

Arkéa says it is too early to give a final amount. Part of the money has already been blocked, and other recovery steps are under way, so the eventual loss tied to the crypto hack could come in lower than either figure.

How the Stolen Funds May Have Been Converted Into Crypto

According to Bitquery, the USDC left accounts at Kraken, Crypto.com and OKX and went to 15 primary wallets before being split across hundreds of addresses.

Many of those wallets had earlier received payments from the same exchanges, which hints that parts of the crypto hack were prepared in advance.

ZachXBT reported that the attacker swapped USDC into ETH at speed, used instant-exchange services, moved funds across chains and converted part of the haul into Monero.

Bitquery’s analysis found much of the money ended up in ETH and DAI. In a November 4 snapshot, it counted around $42.6 million still held on Ethereum-linked addresses tied to the theft.

Tether and Circle can freeze USDT and USDC, but no central issuer can freeze ETH, and Monero is built to hide transaction trails.

What Crédit Mutuel Arkéa Says About Customer Funds and Crypto Hack Recovery

Arkéa has been firm on one point above all. It says the incident has “no financial consequences for our customers,” including those at Fortuneo.

The only visible effect was a delay on some transfers, and almost all operations resumed the same morning under tighter security.

The bank has informed supervisors and is working with judicial and law enforcement authorities. On its finances, Arkéa said the sums involved are “in no way of a nature to undermine the financial strength and soundness of Crédit Mutuel Arkéa.”

The group holds around €211.5 billion in assets, per reports. The bank is also urging customers to watch for phishing.

For now, the crypto hack sits between two accounts. ZachXBT has mapped the money on-chain, while Arkéa has confirmed the attack but not the final number.