Crédit Mutuel Arkéa heist: how $133M left through a service provider and became stablecoins and Monero
Crédit Mutuel Arkéa, a French cooperative banking group with 5.8 million members and EUR 211.5 billion in assets, has confirmed that an intruder reached its systems through a service provider's platform and used the bank's own corporate account to send roughly EUR 118 million, about USD 133 million, to accounts at other banks. The bank disclosed the incident on 4 November 2026 and has declined to confirm the amount.
What the bank has confirmed, and what it has not
In statements carried by French outlets and by BleepingComputer, Arkéa described a sophisticated attack and said the intruder came in directly through a service provider's platform. The bank explicitly ruled out Fortuneo, its own online bank, as the entry point, and ruled out human error by its staff. It said the transfers came from Arkéa's own account rather than from customer accounts, and that customer assets were unaffected. Some transfers were delayed while the bank suspended certain transactions as a precaution. What it has not done is confirm the figure. Asked about the USD 133 million estimate, it told BleepingComputer that it would not confirm the information and could only validate the order of magnitude. That hedge is worth keeping in view: the amount is an investigator's reconstruction from on-chain data, not a number the victim has signed off on. "We do not confirm this information and can only validate the order of magnitude." Crédit Mutuel Arkéa, quoted by BleepingComputer
How a fiat transfer turns into a stablecoin
The mechanics reported so far are unglamorous. According to reporting by Grégory Raymond and others, summarised by ZATAZ, the fraudulent transfers ran across several days rather than in one burst, and the beneficiary names printed on the transfers were chosen to match the names on the receiving accounts. From there it was withdrawn as USDC and USDT, the two largest dollar-denominated stablecoins, into accounts at centralized exchanges. IT for Business, citing the blockchain data firm Bitquery, reports USD 108.8 million in USDC leaving accounts at Kraken, Crypto.com and OKX over roughly 20 hours on 1 and 2 November, dispersed to 15 separate wallets. Why the exchange account is the bottleneck
This is the part of the story worth sitting with. A bank transfer can be recalled, contested and reversed through the correspondent chain; a stablecoin transfer cannot. But a stablecoin held at a regulated exchange is not anonymous either, which is why the accounts themselves were reportedly the problem the fraudsters had to solve first. Reporting describes them as opened in advance under falsified identities good enough to clear know-your-customer checks, with the transfer beneficiary names adjusted to match the account holders' names so the sending bank would accept them. IT for Business adds that the accounts appear to have been opened directly under false identities rather than taken over from real customers, and that eleven of the 15 destination wallets had received funds from the same exchanges previously, in some cases months earlier. If that holds, it describes staging rather than improvisation: exchange accounts and wallet infrastructure prepared before the first transfer left the bank. Twenty-seven thousand ether, then Monero
On the night of 1 to 2 November, about USD 63 million in stablecoins was swapped for 27,553 ETH through UniswapX, a decentralized exchange protocol. The choice is practical. Stablecoin issuers can freeze balances at the contract level when asked; ether has no issuer to ask. The swap also completed in under four hours, per the same reporting, which is faster than a court order. The remainder was split across addresses, moved between chains through bridges, and passed through instant-swap services named in reporting as WellWallet and Kyrrex, before part of it was converted to Monero through a service called Wagyu. Monero conceals sender, receiver and amount by default, so the trace effectively stops at that boundary. This is the standard end state for large crypto thefts now, and it is why the hours immediately after a theft matter more than the weeks that follow. What freezing looks like in practice
Kraken said it restricted the linked accounts from the night of Monday 2 to Tuesday 3 November and that its own systems were not compromised. Crypto.com said it blocked associated funds, and OKX was still investigating as of the reporting. ZachXBT has argued that slow notification of exchanges and authorities allowed more than USD 30 million to be laundered that could otherwise have been caught in time. A freeze is not a recovery. It is a hold on a balance while ownership is argued, and release depends on legal process, on the exchange's own terms, and on showing which claimant the coins belong to. The bank said the incident is now closed and under control, which describes its own containment, not the fate of the money. What the record does not establish
No arrests have been reported. Neither the intruders nor the service provider has been publicly identified, and the bank has given no technical detail about how the platform was used. Attribution is open: ZachXBT has said he is highly confident this was not the Lazarus Group, while another line of reporting, explicitly unproven, points to francophone networks historically associated with president-fraud schemes. Numerama notes that the method itself remains unknown. The entry point is the least satisfying part of the story. An intruder inside a provider's platform is a supply-chain description, and it raises the question that every outsourced banking function raises: which credentials the provider held, and whether the bank could see them being used. Arkéa says it is cooperating with judicial authorities. On the evidence published so far, the transfers, the conversions and the freezes are documented; the intrusion is not. For a related look at how transaction tracing is tested in a courtroom rather than in a blog post, see our account of the Bitcoin Fog trial.
