French bank Arkéa restores services after cyberattack, $133 million crypto drain unconfirmed

French banking group Crédit Mutuel Arkéa says it has contained a cyberattack in which hackers used an external service provider’s platform to initiate fraudulent transfers from its own account, according to a November 4, 2026 statement. The bank has not confirmed blockchain investigator ZachXBT’s estimate that more than $133 million was stolen.

Attackers exploited a third-party service provider

Further clarification from the bank revealed that the attackers did not gain access through Fortuneo, its online banking subsidiary, despite earlier speculation surrounding the platform.

Instead, criminals exploited the platform of an external service provider to reach Crédit Mutuel Arkéa directly. They subsequently used the bank’s own account to initiate fraudulent transactions to other financial institutions.

The bank explained that these transfers may have enabled the attackers to convert the money into cryptocurrency through specialised platforms.

Importantly, the institution stressed that neither customer accounts belonging to its banking networks nor those of its subsidiaries were used in the operation.

The Arkéa bank hack therefore highlights the potential risks associated with third-party service providers and the wider financial infrastructure supporting modern banking operations.

In its clarification, the bank described the incident as a sophisticated external attack rather than an internal human error. It said its security systems detected suspicious activity and enabled its teams to contain the operation.

The institution is now working alongside judicial and law enforcement authorities to establish precisely how the attackers gained access and determine the full extent of the incident.

ZachXBT and Bitquery trace millions in crypto withdrawals

Before the bank publicly acknowledged the attack, blockchain investigator ZachXBT had already raised concerns about unusual cryptocurrency movements involving several centralised exchanges.

On Monday, November 2, the investigator reported suspicious withdrawals exceeding $106 million from accounts associated with an unidentified European financial institution.

He subsequently increased his estimate by another $27 million after identifying additional transactions, bringing the suspected theft above $133 million.

His investigation eventually identified Crédit Mutuel Arkéa as the potential victim, drawing attention to the connection between the bank’s fraudulent transfers and cryptocurrency exchange activity.

Blockchain analytics company Bitquery also investigated the transactions, tracing approximately $108.8 million in USDC withdrawals from accounts at Kraken, Crypto.com and OKX in its initial analysis.

Its subsequent investigation identified additional movements, with its November 5 report tracking approximately $126 million in USDC withdrawals across the three exchanges.

The findings illustrate how blockchain transparency can help investigators follow suspicious financial movements across multiple wallets and cryptocurrency platforms.

However, the reported exchange withdrawals should not automatically be treated as the bank’s confirmed financial loss. The bank has not independently verified that the entire amount identified by blockchain investigators represents money stolen from its accounts.

Exchanges block suspicious funds as recovery efforts intensify

The recovery process has become another important development in the Arkéa bank hack investigation, particularly as some of the suspicious transactions passed through cryptocurrency exchanges.

Kraken and Crypto.com previously confirmed that they had taken action against accounts or funds associated with the suspected theft.

Crypto.com told CoinDesk that it had blocked funds connected to the incident and maintained that customer assets remained secure and accessible.

OKX also reported unusual activity involving an institutional customer account. The exchange said it promptly froze the account and contacted the affected client, adding that there was no indication of a broader impact on other customer accounts.

Meanwhile, Arkéa confirmed that some of the funds involved had been frozen and that additional recovery measures were underway.

Addressing reports that approximately €118 million, equivalent to $133 million, had been stolen, the bank declined to validate the precise figure.

Instead, it said it could only confirm the approximate scale of the amounts involved while its teams continued assessing the financial consequences.

The institution also stressed that the incident would not undermine its overall financial position.

The Arkéa bank hack remains a significant cybersecurity incident, particularly because the suspected attackers exploited an external service provider rather than directly targeting customer banking accounts.

With investigations continuing, the final amount lost, the identities of those responsible and the proportion of funds that can ultimately be recovered remain unresolved.

For now, the bank’s immediate priority is maintaining operational stability, supporting the authorities’ investigation and recovering the affected funds while protecting customer assets.