Crédit Mutuel Arkéa Says Attackers Reached Its Own Account Through a Service Provider’s Platform; the On-Chain Trail Attributed to the Theft Shows $126 Million in USDC Reaching 17 Wallets in 28 Hours, Most of It Moving On Within Minutes

Crédit Mutuel Arkéa, the Brittany-based cooperative banking group with more than 5.8 million members and customers and a €211.5 billion balance sheet, said on November 4 that it had been the victim of “une attaque ayant permis la réalisation d’opérations frauduleuses”, an attack that allowed fraudulent operations to be carried out (our translation here and below). A question-and-answer release that afternoon adds that the attackers “sont passés par la plateforme d’un de nos prestataires et ont ainsi atteint le Crédit Mutuel Arkéa directement”: they went through a service provider’s platform and so reached the group directly. They then used the group’s own account to send transfers to other banks, which “potentiellement” (potentially) let them convert the money to crypto on specialized platforms. The bank does not name the provider or say how its platform was reached. Asked whether €118 million ($133 million) was taken, it answers “Nous ne confirmons pas ces informations et pouvons simplement valider l’ordre de grandeur”: we do not confirm this, and can only validate the order of magnitude.

BleepingComputer and others have relayed that account. We went to the bank’s own documents and to the chain. The bank’s account stops where the money left the banking system, and the transfers it describes leave no trace on a public ledger, but their exit does. Between Sunday, November 1 and Monday, November 2, USDC (a dollar stablecoin) arrived at Ethereum wallets that the on-chain investigator ZachXBT linked to the incident (he listed 15 addresses) and that the analytics firm Bitquery later counted at 17. We read those transfers ourselves. They add up to $126.04 million in about 28 hours, and at the first 15 wallets 94.4 percent of the dollars left within an hour of arriving. We could not tie the wallets to the bank independently: that link rests on ZachXBT’s attribution and on the bank’s validation of the order of magnitude of the press figure. ZachXBT says he has “a high degree of confidence” the actor is not the Lazarus Group, which matters because the incident follows by days the Binance theft the FBI attributes to North Korea. As of November 8 we found no newer statement from the bank, and as of AFP’s November 5 piece nobody had claimed the attack.

What Arkéa has said, and what is still open

The bank issued two releases on November 4: a first release at 13:00 Paris time and a question-and-answer release at 17:30. Read together with press coverage, they leave the following open.

For scale, in our arithmetic: €118 million is about 0.06 percent of the €211.5 billion balance sheet and, if it were a final loss, about half of the roughly €230 million of net profit that Belga reports for the group’s first six months of 2026. Neither is a confirmed loss.

The timeline

All times are UTC unless stated; Paris was on UTC+1. Chain times come from our scan at the end of this post.

By our count the bank’s first statement came 71 hours 34 minutes after the first transfer, 47 hours 31 minutes after ZachXBT’s first post and 43 hours 29 minutes after the last transfer. The bank has not said when it detected the attack, and its Q&A says only that its systems spotted the activity “très rapidement”. What the public record shows is a chain trail that ran from Sunday noon to Monday afternoon, a bank that told a reporter on Tuesday evening it could not confirm, and a public statement on Wednesday.

Figures that do not match, and how they line up

Our scan reproduces both Bitquery totals: $108.63 million for the 15 listed addresses, within about 0.2 percent of its first $108.8 million, and $126,042,367 for 17 wallets, which is its $126.04 million. Our count of 101 transfers of 1 USDC or more into the 15 addresses is lower than Bitquery’s 178 withdrawals, and we have reconciled the dollars, not the counts. The 11 addresses in ZachXBT’s first post took $80.79 million, not $106 million. The difference is the six wallets Bitquery says were missing from that list, which took $45.25 million between them: $126.04 million minus $80.79 million is $45.25 million. Four of them were added in his update, and the other two, 0xe944…8cb9 and 0xd3c1…a7c1, received $17.41 million from the same Kraken-labelled wallet.

The $7 million or more between $126.04 million and ZachXBT’s $133 million is not visible in these wallets. Bitquery writes “We cannot yet explain either gap”. We looked for USDC and USDT arriving at the 15 listed addresses over the same two days on Base, Arbitrum, Polygon and Avalanche and found about $188,000 of USDC on Base and nothing else; the Optimism and BNB Chain endpoints we tried did not answer. On Ethereum the only USDT to reach those addresses since October 30 was two transfers worth $19,546.89 on October 30, before the theft. ZachXBT’s first post speaks of USDC and USDT, but on these wallets the Ethereum record is USDC only, and the remainder may sit at other addresses, on other chains or off-chain.

What the chain shows

How fast the money moved

• 72.7 percent of the dollars left the receiving address within 10 minutes, 94.4 percent within an hour and 99.6 percent within six hours. The dollar-weighted median wait was 3.4 minutes. Bitquery’s median for the 17 wallets is “5 minutes”.
• When ZachXBT posted, the 15 addresses had received $91.39 million and sent on the same amount, to within $4,300. The nine transfers that arrived afterwards, $17.25 million, left the same way.
• The most held at one moment was $17.05 million, at 20:08 on Sunday.

There was never much sitting at these addresses, so a freeze at the stablecoin issuer would have had to land within minutes. Bitquery says Circle froze none of the USDC and that Tether froze about $1.1 million of USDT. We found no Circle or Tether blacklist flag on any of the 15 addresses at block 26,372,169 (19:12 UTC on November 8), where they hold $871.84 of USDC and $2,367.96 of USDT between them. Bitquery adds that about $62.98 million of USDC and USDT was sold through the UniswapX auction for 27,553 ETH in roughly four hours from 23:44 on Sunday, and that $37.26 million was still on Ethereum on November 5 at addresses it ties to the thief, mostly as ETH. We did not verify those downstream figures.

Who paid the wallets

92 of the 101 transfers into the 15 addresses, $102.65 million or 94.5 percent, came from one address that Bitquery labels Kraken’s main wallet. That address itself took in $541.97 million of USDC during the same two days, which fits an exchange wallet and not a thief’s. Bitquery says Kraken paid 95 percent of the total, that OKX paid first and that Crypto.com also paid. It says Kraken and Crypto.com told Cointelegraph that their platforms remained secure, and Crypto Briefing reports that Kraken restricted the accounts and “said its own systems and customer accounts were not compromised”, that Crypto.com “took steps to block related funds” and that OKX “began reviewing the allegations”. We could not verify the labels, did not contact the exchanges, and make no claim about any exchange’s conduct.

Bitquery also says 12 of the 17 wallets had taken payouts from the same exchanges before the theft, two of them since May. Its first reading was a break-in at the victim’s own exchange accounts, but it writes that the bank’s account “points elsewhere”: “If so, the exchange accounts and the wallets belonged to the attackers from the start, and the earlier use was part of the setup.” That reading is Bitquery’s, not ours, and it fits what the reporter Grégory Raymond’s source describes: an organized network relying on many mule accounts.

Where the accounts disagree

• The entry point. The Next Web reports that Presse-citron, citing Raymond and an unnamed source, said the funds were withdrawn through Fortuneo and converted through accounts opened with false identities. The bank says “aucune ‘entrée’ ne s’est faite par Fortuneo” (no entry was made through Fortuneo). Raymond’s own X thread, which we read, says the fiat left the bank and was turned into crypto afterwards, and does not name Fortuneo in the post we could read.
• Whose account. OCCRP’s summary line says the money was siphoned “from its corporate accounts”, but the same article later says the attackers used the bank’s “proprietary accounts”, which matches the bank’s “compte propre”. The bank says no customer account was used.
• How long. ZachXBT writes that “The attack on the bank occurred for multiple days”, and AFP quotes a cybersecurity consultant describing an operation that “se serait étalée sur plusieurs heures, voire plusieurs jours” (would have been spread over several hours, even several days). The exchange payouts on the chain ran for about 28 hours. Bitquery notes that Raymond’s sources “describe the scheme running for several days, which may be true of the bank transfers that the chain cannot see”.
• Disclosure. ZachXBT’s Nov 3 post says “No proper incident disclosure has resulted in $30M+ being laundered away which could have been frozen by EU law enforcement.” The bank says it informed supervisors at detection and has not said when that was. The chain cannot settle it: the $17.25 million that arrived after ZachXBT’s first post left the receiving addresses within minutes, like the earlier money.

What is still unknown

• The provider, and whether others use it. AFP quotes Antoine Hautin of the consultancy Almond as saying the first thing to check is whether the supplier serves several banks, which would raise a question of “risque systémique” (systemic risk).
• How a platform compromise became payments. The release says the bank’s own account was used. It does not say which credentials, limits or approvals stood in the way.
• When the bank detected the attack and when the transfers stopped. The public record has a Sunday-to-Monday chain trail, a Wednesday statement and an app outage that franceinfo reports in its Wednesday article.
• The final loss. The bank validates an order of magnitude and says a portion was blocked. The only on-chain freeze Bitquery found is about $1.1 million of USDT.
• Who did it. As of AFP’s November 5 piece nobody had claimed the attack, and the only attribution on offer is negative: ZachXBT says the actor is not the Lazarus Group.
• The link between the wallets and the bank. Bitquery’s disclaimer says the bank has confirmed a cyberattack but “has not linked it to these wallets; that link rests on public reporting and on-chain behaviour”.

What to do

If you are an Arkéa customer

The bank says your assets are unaffected and the only effect was delayed execution of some transfers. It warns that phishing is possible and asks you never to share identifiers, passwords, card numbers or SMS validation codes, and to call your adviser directly to confirm any message you are unsure about.

If you run payment or treasury integrations

These are our suggestions, not claims about how Arkéa’s setup worked.

1. List every third-party platform that can initiate, approve or release payments from your own accounts, and what each can do without a second person.
2. Put limits and a second approval that lives outside that platform on outbound transfers, especially to first-time beneficiaries.
3. Alert on payment size and speed outside working hours; the first transfer here came on a Sunday that was also a public holiday.
4. Rehearse the call chain for a freeze, from your counterparty banks’ fraud desks to exchanges’ compliance contacts and stablecoin issuers, and time it against the numbers above: 94.4 percent of the dollars at the first 15 wallets were gone within an hour.
5. If you are an EU financial entity, know where your incident-reporting clocks start and who makes the classification call; our NIS2 and DORA post covers that, and our Binance checklist post covers the same stopwatch problem for wallet signing.

What we checked

We read the bank’s two November 4 releases, ZachXBT’s three Telegram posts, Bitquery’s November 5 investigation, franceinfo, AFP’s question-and-answer piece and Belga’s dispatch (both republished by the Belgian outlet DH), OCCRP, The Next Web, Bitcoin.com, Crypto Briefing and Raymond’s X thread through a public mirror. Le Télégramme’s original report sits behind a bot check, so we cite it through franceinfo and Le Monde Informatique. Bitquery’s page prints only some of the 17 addresses in full, so we used the two it prints that ZachXBT does not list. We did not contact the bank, ZachXBT, Bitquery or any exchange.

The script below reads USDC Transfer events on Ethereum mainnet for the 15 listed addresses from 00:00 UTC on November 1 to 00:00 UTC on November 3, through one public archive-capable endpoint, using only the Python standard library. It ignores transfers under 1 USDC: the logs hold 125 of them, worth $2.03 in all, many sent from look-alike addresses (a trick known as address poisoning), and they are dust, not payouts. It takes about a minute. If the endpoint stops answering, any archive-capable Ethereum endpoint will do.

# arkea_scan.py
# Read-only check of USDC transfers on Ethereum mainnet, 1 to 3 November 2026 (UTC).
# Standard library only. It talks to one public archive-capable JSON-RPC endpoint.
import datetime as dt
import json
import time
import urllib.request
from collections import defaultdict, deque

RPC = "https://mainnet.gateway.tenderly.co"
USDC = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48"
USDT = "0xdac17f958d2ee523a2206206994597c13d831ec7"
AT_BLOCK = 26372169  # a block from 8 November 2026, 19:12 UTC, so the balances below do not drift
TRANSFER = "0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef"
KRAKEN_MAIN = "0x2744dfd9898f0babbc570cc594bbbc84b487a22b"  # Bitquery's label, not verified here

# The 11 addresses in ZachXBT's first Telegram post (2 Nov 2026, 12:28:49 UTC)
FIRST_POST = """
0xADd95cD98E0288ba69785E3151E1db86adF8Dd58 0x29e9D7715D935e0D0D4B0DD0efC952A97E551020
0x378B4f150707C283574DC89739608D29036D57d5 0x795a9d22F233024487161Fe6daFf73397c162621
0x730Bcb1296758c377149d7409f98f041cf723992 0x12D9012731eb0D54871A31Af5566Eb9ECCa351Db
0x5A154f77852ed274Fd6F4c324a1Ee27809052FF7 0xA1096A66f9ed58A9594A6A1ad67A5472C0907224
0x90F0b6D51ed2FE2348A45b2C49BC441E959bc557 0x8A97BC406180e28b11C5495fA099BF5119c6C6B0
0xd010cba790a6ab0048da18f2fbe8e3faf463a16a
""".split()
# The 4 addresses in his update (3 Nov 2026, 07:31:15 UTC)
SECOND_POST = """
0x5cf70edce65847ef989933c3072fb0e7f335abc1 0xe378cdccb369a64a0190577787ef61ca2eefa6b2
0x3e6c3d135ca8f8be793e5fe1715ce6c057d140f2 0x99d314e6970b8d3db0dbe6f6e041cc904143400f
""".split()
# Two wallets that appear on Bitquery's page but in neither post
EXTRA = ["0xe944f94a773027d5ca80806955dc670e587a8cb9", "0xd3c1cda4d49fe4280a94b43c92a2e4acf530a7c1"]

UTC = dt.timezone.utc
T_START = int(dt.datetime(2026, 11, 1, tzinfo=UTC).timestamp())
T_END = int(dt.datetime(2026, 11, 3, tzinfo=UTC).timestamp())
T_ALERT = int(dt.datetime(2026, 11, 2, 12, 28, 49, tzinfo=UTC).timestamp())
T_BANK = int(dt.datetime(2026, 11, 4, 12, 0, 0, tzinfo=UTC).timestamp())  # 13:00 in Paris


def rpc(method, params):
    body = json.dumps({"jsonrpc": "2.0", "id": 1, "method": method, "params": params}).encode()
    for attempt in range(5):
        try:
            req = urllib.request.Request(RPC, body, {"Content-Type": "application/json", "User-Agent": "Mozilla/5.0"})
            with urllib.request.urlopen(req, timeout=60) as r:
                reply = json.load(r)
            if "error" not in reply:
                return reply["result"]
        except OSError:
            pass
        time.sleep(2 * (attempt + 1))
    raise RuntimeError("RPC failed: " + method)


_stamps = {}
DUST = []


def stamp(block):
    if block not in _stamps:
        _stamps[block] = int(rpc("eth_getBlockByNumber", [hex(block), False])["timestamp"], 16)
    return _stamps[block]


def block_at(ts, hi):
    lo = 1
    while lo < hi:
        mid = (lo + hi) // 2
        lo, hi = (mid + 1, hi) if stamp(mid) < ts else (lo, mid)
    return lo


def pad(address):
    return "0x" + "0" * 24 + address[2:].lower()


def usdc_logs(frm, to, lo, hi):
    topics = [TRANSFER, [pad(a) for a in frm] if frm else None, [pad(a) for a in to] if to else None]
    out = []
    for log in rpc("eth_getLogs", [{"fromBlock": hex(lo), "toBlock": hex(hi), "address": USDC, "topics": topics}]):
        block = int(log["blockNumber"], 16)
        out.append({"t": stamp(block), "from": "0x" + log["topics"][1][-40:], "to": "0x" + log["topics"][2][-40:],
                    "usd": int(log["data"], 16) / 1e6})
    # Address-poisoning dust (tiny transfers from look-alike addresses) is not a payout, so it is left out.
    DUST.extend(x for x in out if x["usd"] < 1)
    return sorted((x for x in out if x["usd"] >= 1), key=lambda x: x["t"])


def show(t):
    return dt.datetime.fromtimestamp(t, UTC).strftime("%Y-%m-%d %H:%M:%S")


def hours(seconds):
    return f"{seconds // 3600} h {seconds % 3600 // 60:02d} min"


latest = int(rpc("eth_blockNumber", []), 16)
lo, hi = block_at(T_START, latest), block_at(T_END, latest)
listed = [a.lower() for a in FIRST_POST + SECOND_POST]
ins, outs = usdc_logs(None, listed, lo, hi), usdc_logs(listed, None, lo, hi)
print(f"window: blocks {lo} to {hi}, {show(stamp(lo))} to {show(stamp(hi))} UTC")
print(f"ignored {len(DUST)} transfers under 1 USDC (dust), {sum(x['usd'] for x in DUST):.4f} USDC in all")
print(f"into the {len(listed)} listed addresses: {len(ins)} transfers, {sum(x['usd'] for x in ins):,.2f} USDC")
print(f"  first {show(ins[0]['t'])}, last {show(ins[-1]['t'])} UTC, span {hours(ins[-1]['t'] - ins[0]['t'])}")
for name, group in (("first post", FIRST_POST), ("update", SECOND_POST)):
    g = {a.lower() for a in group}
    print(f"  {name}: {len(group)} addresses, {sum(x['usd'] for x in ins if x['to'] in g):,.2f} USDC")
kr = [x for x in ins if x["from"] == KRAKEN_MAIN]
print(f"  of which from the wallet Bitquery labels Kraken: {len(kr)} transfers, {sum(x['usd'] for x in kr):,.2f}")
intake = usdc_logs(None, [KRAKEN_MAIN], lo, hi)
print(f"  that wallet itself took in {sum(x['usd'] for x in intake):,.0f} USDC in the same two days")
extra = usdc_logs([KRAKEN_MAIN], EXTRA, lo, hi)
print(f"from that wallet into the two extra wallets: {len(extra)} transfers, {sum(x['usd'] for x in extra):,.2f}")
print(f"all 17 wallets: {sum(x['usd'] for x in ins) + sum(x['usd'] for x in extra):,.2f} USDC")

print("\nreceived and sent on, cumulative, by the 15 listed addresses")
for label, t in (("ZachXBT first post", T_ALERT), ("end of 2 Nov", T_END)):
    got = sum(x["usd"] for x in ins if x["t"] <= t)
    sent = sum(x["usd"] for x in outs if x["t"] <= t)
    print(f"  {label}: received {got:,.0f}, sent on {sent:,.0f}")
after = [x for x in ins if x["t"] > T_ALERT]
print(f"  arrived after the first post: {len(after)} transfers, {sum(x['usd'] for x in after):,.2f}")
print(f"  sent on from the 15 addresses: {len(outs)} transfers to {len({x['to'] for x in outs})} recipients")

events = sorted([(x["t"], 0, "in", x) for x in ins] + [(x["t"], 1, "out", x) for x in outs], key=lambda e: e[:2])
held, peak, queues, waits = 0.0, (0.0, 0), defaultdict(deque), []
for t, _, kind, x in events:
    held += x["usd"] if kind == "in" else -x["usd"]
    peak = max(peak, (held, t))
    if kind == "in":
        queues[x["to"]].append([t, x["usd"]])
        continue
    need, queue = x["usd"], queues[x["from"]]
    while need > 1e-6 and queue:
        take = min(queue[0][1], need)
        waits.append((t - queue[0][0], take))
        need -= take
        queue[0][1] -= take
        if queue[0][1] <= 1e-6:
            queue.popleft()
total = sum(usd for _, usd in waits)
print(f"\npeak held at one moment: {peak[0]:,.0f} at {show(peak[1])} UTC")
for label, limit in (("10 minutes", 600), ("1 hour", 3600), ("6 hours", 21600)):
    print(f"  {sum(u for s, u in waits if s <= limit) / total:.1%} of dollars left within {label}")
running = 0.0
for seconds, usd in sorted(waits):
    running += usd
    if running >= total / 2:
        print(f"  dollar-weighted median wait: {seconds / 60:.1f} minutes")
        break

print("\nelapsed time to the bank's 13:00 Paris statement of 4 November")
print(f"  from the first transfer: {hours(T_BANK - ins[0]['t'])}")
print(f"  from the first post:     {hours(T_BANK - T_ALERT)}")
print(f"  from the last transfer:  {hours(T_BANK - ins[-1]['t'])}")

print(f"\nstate at block {AT_BLOCK} ({show(stamp(AT_BLOCK))} UTC), the 15 listed addresses together")


def call(token, selector, address):
    return int(rpc("eth_call", [{"to": token, "data": selector + pad(address)[2:]}, hex(AT_BLOCK)]), 16)


bal_usdc = sum(call(USDC, "0x70a08231", a) for a in listed) / 1e6
bal_usdt = sum(call(USDT, "0x70a08231", a) for a in listed) / 1e6
flag_usdc = sum(call(USDC, "0xfe575a87", a) for a in listed)
flag_usdt = sum(call(USDT, "0xe47d6060", a) for a in listed)
print(f"  USDC balance {bal_usdc:,.2f}, USDT balance {bal_usdt:,.2f}")
print(f"  addresses blacklisted by Circle: {flag_usdc}, by Tether: {flag_usdt}")

Its output on November 8:

window: blocks 26316189 to 26330541, 2026-11-01 00:00:11 to 2026-11-03 00:00:11 UTC
ignored 125 transfers under 1 USDC (dust), 2.0311 USDC in all
into the 15 listed addresses: 101 transfers, 108,633,306.84 USDC
  first 2026-11-01 12:25:23, last 2026-11-02 16:30:59 UTC, span 28 h 05 min
  first post: 11 addresses, 80,794,947.36 USDC
  update: 4 addresses, 27,838,359.48 USDC
  of which from the wallet Bitquery labels Kraken: 92 transfers, 102,654,893.93
  that wallet itself took in 541,974,372 USDC in the same two days
from that wallet into the two extra wallets: 95 transfers, 17,409,060.63
all 17 wallets: 126,042,367.47 USDC

received and sent on, cumulative, by the 15 listed addresses
  ZachXBT first post: received 91,387,317, sent on 91,391,606
  end of 2 Nov: received 108,633,307, sent on 108,637,502
  arrived after the first post: 9 transfers, 17,245,989.48
  sent on from the 15 addresses: 45 transfers to 30 recipients

peak held at one moment: 17,052,965 at 2026-11-01 20:08:11 UTC
  72.7% of dollars left within 10 minutes
  94.4% of dollars left within 1 hour
  99.6% of dollars left within 6 hours
  dollar-weighted median wait: 3.4 minutes

elapsed time to the bank's 13:00 Paris statement of 4 November
  from the first transfer: 71 h 34 min
  from the first post:     47 h 31 min
  from the last transfer:  43 h 29 min

state at block 26372169 (2026-11-08 19:12:11 UTC), the 15 listed addresses together
  USDC balance 871.84, USDT balance 2,367.96
  addresses blacklisted by Circle: 0, by Tether: 0

Limits: the scan covers one token on one chain; the wallets are attributed by ZachXBT, not by the bank; labels such as “Kraken main wallet” are Bitquery’s and we did not confirm them; and the elapsed-time figures treat the bank’s 13:00 Paris release as its first statement, which is the earliest we found, not a claim that nothing earlier exists.