Inside the $133M Arkea Bank Hack: How Stolen Funds Moved Through Crypto

The $133M Arkea Bank Hack is a major cyber theft in which attackers moved more than $133 million from French banking group Crédit Mutuel Arkéa into crypto exchange accounts before laundering the funds through stablecoins, Ethereum, bridges and Monero. On November 4, 2026 the bank confirmed an attack that enabled fraudulent transactions, while on-chain investigators tracked the rapid cross-chain movement of the stolen money.

This article explains how the theft reportedly worked, how the money moved through stablecoins, Ethereum, bridges and Monero, and what the bank has and has not confirmed. It also covers what customers should do now. Several details remain unverified, so we mark them clearly.

Key Takeaways

• Blockchain investigators estimate that more than $133 million was stolen from French group Crédit Mutuel Arkéa, but the bank has not confirmed the total or how attackers got in.

• The funds reportedly went to exchange accounts opened with falsified identities, then were swapped into Ethereum and pushed through bridges, instant swaps and Monero.

• The bank says retail customers face no financial impact, and the incident is under control. Customers should still watch for scam calls that exploit the news.

The Arkea Bank Hack in Simple Terms

The Arkea bank hack is a cyber-enabled theft that moved an estimated $133 million out of a French banking group by sending bank transfers to crypto exchange accounts and then laundering the money on-chain. In plain words, criminals found a way to send large payments out of the bank, and crypto gave them a fast route to scatter the proceeds.

Think of it as a two-stage heist. First, money leaves the bank through transfers that look legitimate. Second, the money is converted, split across hundreds of wallets and moved between blockchains so that it becomes hard to trace and freeze.

What the Bank Has Confirmed

On November 4, 2026, Crédit Mutuel Arkéa said it was the target of an attack that enabled fraudulent transactions and that the incident was now under control. It temporarily suspended certain transactions as a precaution and notified the authorities.

The bank has not disclosed the amount lost, the method of entry or who is responsible. It also did not say whether the stolen assets were fiat or crypto, so every figure below should be read as an investigator's estimate.

Who Is Involved: The Key Entities

Crédit Mutuel Arkéa is a cooperative group based in Le Relecq-Kerhuon, near Brest. It served about 5.6 million customers at the end of 2025 and manages more than €230 billion in assets. Reports link the attack to Fortuneo, the group's online bank, although the bank's own statement does not name the brand.

ZachXBT is an independent on-chain investigator who first flagged the suspicious withdrawals on November 2 and later raised his estimate to more than $133 million. Bitquery, a blockchain data provider, tracked the stablecoin withdrawals. Kraken, Crypto.com and OKX are the exchanges whose accounts received the funds.

How the Exchanges Responded

Crypto.com said it restricted the movement of linked funds and that customer funds remain secure. Kraken and Crypto.com both said their own systems were not compromised, and that the attackers used accounts that passed identity checks.

French authorities are involved as well. The bank informed the Banque de France, and French cyber police and digital forensic teams are reportedly investigating. No public details about a named prosecutor or a filed complaint have been confirmed.

Arkea Bank Hack Timeline: What We Know and What We Don't

This quick-reference table separates what is confirmed from what is still an estimate or a claim.

How to Read These Numbers

The $133 million figure comes from on-chain tracing, not from a bank filing. It could rise if over-the-counter trades are counted, or fall if funds were frozen. Treat it as a working estimate until the bank or the authorities publish their own.

How Was Arkea Bank Hacked? The Reported Method

The entry point is still unknown. One reported theory is that attackers bypassed the bank's remittance risk controls and gained the ability to start outgoing transfers with freely chosen recipient names. Others point to a payment system compromise or an internal failure, and no authority has attributed the attack yet.

What is clearer is the receiving side. The attackers reportedly opened accounts at crypto exchanges using falsified identities that passed verification. The bank transfers that funded those accounts carried the exact name of the account holder, which made them look routine.

Why Payee Checks Did Not Stop It

Europe's Verification of Payee rule, in force since October 9, 2025, checks that a name matches an IBAN. It does not check that the named person is real. If a forged identity passes an exchange's onboarding, the name on the transfer can match perfectly.

Whether a third party was involved in the breach has not been confirmed. Until the bank explains the method, any claim about a supplier or partner compromise should be treated as speculation.

Stay ahead of crypto risks and market moves. Register on Bitrue to access secure trading tools and explore digital assets with greater confidence.

How Hackers Laundered 133 Million Through Crypto

Bitquery counted about $108.8 million in USDC withdrawn from Kraken, Crypto.com and OKX accounts within 21 hours on November 1 and 2. The funds were then spread across hundreds of wallets. Stablecoins such as USDC and USDT come first because they are easy to move and hold a stable value.

On the night of November 1 to 2, roughly $63 million in stablecoins was swapped for 27,553 ETH through Uniswap in about four hours. Swapping into Ethereum matters because stablecoin issuers can freeze their tokens, while ETH cannot be frozen in the same way.

Bridges, Instant Swaps and Monero

After the swaps, the trail reportedly went through instant exchange services, cross-chain bridges and Monero, a privacy coin built to hide senders, receivers and amounts. Each hop breaks the visible chain of custody and makes tracing slower and less certain.

Part of the money may also have left through offline over-the-counter trades. That is one reason the total could grow. Bitquery also spotted a transfer of 396 ETH to a Kraken deposit address, but could not confirm whether it was frozen or who owned the account.

The Race to Freeze Funds

ZachXBT said that delays in alerting regulators and exchange compliance teams let attackers launder more than $30 million that authorities might otherwise have frozen. The window for freezing funds is short, and exchanges generally need official confirmation from the victim before they act.

Who Is Behind It? What Investigators Say

ZachXBT said he has high confidence that North Korea's Lazarus Group was not responsible, citing different laundering patterns. He suggested the attacker is likely French-speaking and connected to users of cybercrime forums. This is an investigator's assessment, not an official finding.

Attribution in crypto theft cases is often slow and revised many times. Treat any name attached to the attack in the coming days with caution until law enforcement says otherwise.

Credit Mutuel Arkea Customer Safety: What You Should Do

The bank states that retail clients face no financial impact and that deposits remain protected. Still, customers can take sensible steps. Keep statements and dated screenshots, check your accounts regularly and report anything unfamiliar to the bank straight away.

Under European payment rules, customers generally must report unauthorised transactions without delay, within 13 months of the debit, and banks are generally expected to refund by the end of the next business day. Check your own account terms or ask the bank for specifics.

Watch for Opportunistic Scams

Fraudsters often exploit headlines like this one. A common pattern is a caller posing as a bank adviser who mentions the attack and asks you to approve a transaction to block fraud. Hang up, and call the number printed on your bank card instead.

Why the Arkea Hack Matters for Banks and Crypto Platforms

For banks, the case shows that name matching alone is not a full defence. Stronger controls on new beneficiaries, large outgoing transfers and unusual payments to crypto exchanges now look essential. For exchanges, it highlights that identity checks are a critical choke point against laundering.

For regulators, speed is the key lesson. Funds moved from stablecoins to Ethereum, bridges and privacy coins in hours, while official confirmation took days. Faster coordination between banks, exchanges and investigators could decide how much stolen money gets frozen next time.

Summary

The reported $133 million theft from Crédit Mutuel Arkéa shows how quickly bank fraud can turn into a cross-chain laundering operation. The bank confirmed a cyberattack and says customers are protected, while investigators describe falsified exchange identities, stablecoin swaps into ETH and a trail through bridges and Monero.

Much remains unknown, including the method of entry, the exact loss and who is responsible. The sensible approach is to rely on confirmed statements, treat on-chain estimates as provisional, and stay alert to scams that follow the news.

Disclaimer: The views expressed belong exclusively to the author and do not reflect the views of this platform. This platform and its affiliates disclaim any responsibility for the accuracy or suitability of the information provided. It is for informational purposes only and not intended as financial or investment advice.

FAQ

How much was stolen in the Arkea bank hack?

On-chain investigators estimate more than $133 million, or about €118 million. The bank has not confirmed the total, so the figure remains an estimate that could change.

How was Arkea bank hacked?

The method has not been disclosed. Reports say attackers bypassed transfer controls and sent funds to exchange accounts opened with falsified identities. The exact entry point is still unknown.

How did hackers launder the stolen money?

Funds reportedly went from stablecoins into Ethereum, then through instant swaps, cross-chain bridges and Monero. Some may also have moved through over-the-counter trades.

Are Credit Mutuel Arkea customers safe?

The bank says retail clients face no financial impact and deposits remain protected. Customers should still monitor accounts and ignore unsolicited calls asking them to approve transactions.

Who is responsible for the Arkea hack?

No one has been officially named. ZachXBT said the attack was not linked to North Korea's Lazarus Group and suggested the attacker may be French-speaking.

Disclaimer: The views expressed belong exclusively to the author and do not reflect the views of this platform. This platform and its affiliates disclaim any responsibility for the accuracy or suitability of the information provided. It is for informational purposes only and not intended as financial or investment advice.