Crédit Mutuel Arkéa confirmed on November 4, 2026 a cyberattack that enabled fraudulent transactions. This announcement comes a few hours after onchain investigator ZachXBT named the Breton bank as the alleged victim of a theft worth more than $133 million. This amount corresponds to ZachXBT’s estimate, taken up by Le Télégramme, which converts it into 118 million euros. Arkéa does not, however, confirm this amount. At the same time, the flow of funds is the subject of two opposing readings: exchange accounts emptied for one, bank transfers converted into crypto for the other.
In brief
- Crédit Mutuel Arkéa confirms a hack on November 4, 2026.
- ZachXBT estimates the theft to be worth more than $133 million.
- Bitquery traces $108.8 million worth of USDC on Ethereum.
- The origin of funds remains disputed between crypto accounts and bank transfers.
- Tether has frozen $1.14 million worth of USDT, according to Bitquery.
What do we really know about computer hacking at Crédit Mutuel Arkéa?
According to AFP, Crédit Mutuel Arkéa recognized on November 4, 2026 a hack that allowed fraudulent operations. The bank considers the incident under control, has temporarily suspended certain transactions as a precaution and has confirmed neither the amount nor the method of the embezzlement. This cyberattack comes less than a week after the Binance hack. The crypto exchange estimates the scale of this other incident at $6.3 billion in affected assets.
THE figure of 133 million dollars is cited by Le Télégramme, without the Arkéa bank validating it. The daily also indicates that Arkéa notified the Banque de France, which made no comments to AFP. An email from Arkéa, shared on X by Louis Tellier, goes in the same direction as the message addressed to customers:
This incident has no financial consequences for them.
Crédit Mutuel Arkéa, message to its customers, November 4, 2026, cited by AFP.
How did Bitquery trace the $108.8 million?
According to Bitquery analysis, $108.8 million worth of USDC left accounts opened at Kraken, Crypto.com and OKX in 21 hours, on November 1 and 2, 2026, to 15 crypto wallets. The first withdrawal was at 12:25 UTC on November 1. As of 23:10 UTC, 98% of the funds were out, with Kraken having paid out 95%.
THE first reports of the hack come from ZachXBT. They were relayed on X on November 2 by Officer’s Noteswith a list of 11 addresses. Bitquery finds four additional ones, which received $28 million and were not included in this list.
However, the two analyzes do not give the same reading of the assets transferred:
- ZachXBT talks USDC and USDT;
- Bitquery only analyzes Ethereum and therefore only finds USDC output from the exchange. USDT appears after trades.
The money then changes shape. USDC and USDT are stablecoins whose issuers, Circle and Tether, can freeze tokens. Ethereum (ETH), on the other hand, does not rely on a central issuer capable of blocking units in circulation.
On the night of November 1 to 2, Bitquery counts $62.98 million in stablecoins converted into 27,553 ETH in about four hours via UniswapX, at almost $2,286 per unit. The rest passes through DAI, before conversion into Monero (XMR).
Are the funds coming from bank accounts or crypto accounts?
Two readings also oppose November 4, 2026. Bitquery does not name the victim of the hack. The company notes, however, that 11 of the 15 recipient wallets had already received funds from these crypto exchanges, the oldest transfer dating back to May 4. She thus favors the hypothesis of an intrusion into the account holder.
Conversely, journalist Grégory Raymond reports that bank money would have been taken out before being converted into cryptocurrencies. According to his thread on X, the hack would specifically target Fortuneo, the group’s online bank. The transfers were allegedly issued in the exact name of the holder of crypto accounts opened by fraudsters, as part of a “mule” network. This point, however, is based on his information alone. Arkéa has not detailed the method according toAFP.
Are there any recoverable funds left?
As of November 3, 2026 at 1:27 p.m. UTC, $61 million was still on Ethereum in addresses linked to the hacker. This represents 56% of the amount traced by Bitquery, including $53.2 million in ETH. Around $50.3 million had already been released through deposits on crypto exchanges.
Only part of the funds therefore remains likely to be frozen by stablecoin issuers.
- Tether froze $1.14 million worth of USDT at 11:10 p.m. UTC on November 2.
- For its part, Circle had not frozen any of the remaining $2.53 million in USDC as of the date of Bitquery’s statement.
However, another intervention should be noted: Crypto.com confirmed it blocked funds linked to the hack in order to prevent their circulation on its platform. The exchange specifies that its users’ funds remain secure and accessible.
The gap remains significant with Binance, where Bitquery has more than 2 billion dollars frozen in a few hours by Tether and Circle. On November 3, 396 ETH also entered a Kraken deposit address. This transfer allows the platform to identify the credited account, without establishing alone that the funds have been frozen.
According to ZachXBT, more than 30 million dollars would have been laundered whereas the European authorities could have frozen them with a proper declaration. This is an accusation by the investigator, not an established fact.
What does European law provide for declaring this hack?
THE DORA regulation, applicable since January 17, 2025requires financial entities to report major incidents related to information and communication technologies (including hacks) to their competent authority.
THE delegated regulation (EU) 2025/301 sets the initial notification deadlines:
- within four hours of the incident being classified as major;
- no later than 24 hours after the financial entity becomes aware of the incident.
An interim report must then be sent no later than 72 hours after sending the initial notification. A final report is also planned in the month following the interim report or its last update.
It remains to be seen whether this hack was classified as major and when. For the moment, Arkéa has not specified this. Le Télégramme nevertheless indicates that the Banque de France has been notified.
At this stage, two elements are therefore established: Crédit Mutuel Arkéa confirmed a computer hack on November 4, 2026 and Bitquery traced movements of funds towards ETH and Monero. But the total amount of the damage, the exact origin of the funds and the operating method remain to be clarified. Four amounts, several sources and still no confirmation of the $133 million. The file remains to be followed…
Maximize your Tremplin.io experience with our ‘Read to Earn’ program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
