Crédit Mutuel Arkéa Confirms Attack; $133M Theft Suspected

By Tom Whitfield

Suspected withdrawals linked to a cyberattack on French banking group Crédit Mutuel Arkéa exceeded $133 million by Tuesday, according to on-chain investigator ZachXBT, who identified Arkéa as the potential victim on Wednesday. Arkéa confirmed the attack the same day and said nearly all operations had resumed after security checks and additional safeguards.

Arkéa said attackers accessed its systems through a service provider’s platform, not through its online-banking subsidiary Fortuneo. They transferred money from the bank’s own account to other financial institutions, potentially allowing those recipients to convert it into crypto.

Customer funds remained unaffected. The disruption delayed only certain transfers, separating a limited operational interruption from the suspected loss tied to Arkéa’s own account. The bank continued assessing the financial impact as it pursued recovery.

How did investigators trace the suspected theft?

Withdrawals from crypto exchanges first exposed the suspected theft. Blockchain analytics firm Bitquery traced withdrawals from accounts at Kraken, Crypto.com and OKX before the victim became public, giving investigators an on-chain record to follow the funds.

ZachXBT’s estimates changed across three reporting days:

• Monday: ZachXBT flagged more than $106 million in suspicious withdrawals.
• Tuesday: He raised the estimate above $133 million after finding another $27 million.
• Wednesday: His report identified Arkéa as the potential victim.

ZachXBT’s Wednesday report connected the earlier exchange withdrawals to Arkéa as the potential victim. Arkéa then confirmed that an attack had occurred, though it did not validate either numerical estimate.

What has Arkéa confirmed?

“We are not confirming these figures; we can only confirm the approximate scale,” Arkéa said, according to a machine translation. The wording left both numerical thresholds as investigator estimates rather than bank-verified losses.

Arkéa also said some funds had been frozen and further recovery efforts were underway. The statement acknowledged an approximate scale without establishing the amount stolen, the final financial impact or the value successfully recovered.

How did Kraken and Crypto.com respond?

Kraken and Crypto.com previously told Cointelegraph that they had restricted accounts or blocked funds linked to the suspected theft. Both exchanges maintained that their platforms remained secure.

Bitquery’s tracing covered OKX as well, but the disclosed account restrictions or fund blocks came from Kraken and Crypto.com. Those steps can prevent identified funds from moving once account links are established, without quantifying how much Arkéa can ultimately recover.

The service-provider route also kept Fortuneo outside the reported access path. Arkéa reported no loss of customer funds, even as it continued to assess the financial effect of transfers from its own account.

What remains unresolved before Arkéa reports losses?

Three items remained open on Wednesday:

• A final financial-impact figure for the attack.
• The amount frozen and the amount recovered.
• The amount, if any, of the suspected $133 million converted into crypto.

Arkéa announced no deadline for completing its assessment or issuing a recovery update. Until it publishes those figures, the $133 million remains ZachXBT’s estimate rather than Arkéa’s confirmed loss, even though the bank has acknowledged an approximate scale and frozen some funds.

The next disclosure to watch is Arkéa’s completed financial-impact assessment and recovery update. It should clarify how the bank’s approximate loss compares with the current on-chain estimate.