Crédit Mutuel Arkéa Confirms Attack Behind a $133M Crypto Money Trail

French cooperative bank Crédit Mutuel Arkéa said Wednesday that outside attackers used one of its own accounts to make fraudulent transfers. On-chain investigator ZachXBT had traced more than $133 million moving through crypto exchanges.

In a statement posted at 5:30 p.m. Paris time, or 11:30 a.m. ET, the bank said the attackers came in through "the platform of one of our service providers" and reached the bank directly (our translation). It denied press reports that they entered through Fortuneo, its online bank. Client accounts were not used, and client holdings are unaffected, the bank said.

The bank backs the size, not the number

Asked whether €118 million, or $133 million, had been stolen, the bank said it does not confirm those figures and "can simply validate the order of magnitude." Part of the money may have been blocked, and recovery efforts are under way, it said. It added that the amounts do not threaten its financial health.

The path from bank to blockchain matters here. According to the bank, the attackers sent money from its account to other banks. From there, it says, the cash may have been converted into crypto on specialist platforms. That turns ordinary bank transfers into stablecoins, which can leave an exchange for a private wallet within minutes.

Blockchain data firm Bitquery traced $108.8 million in USDC withdrawn from Kraken, Crypto.com and OKX in about 21 hours, Cyberattaque.org reported. Bitquery found about $63 million of stablecoins swapped into 27,553 ETH within four hours, the site reported. Kraken and Crypto.com said they restricted linked accounts and that their own systems were not breached, it added.

No one has been named or charged. The bank says it is working with police and judicial authorities.

In our opinion: This is a bank hack first and a crypto story second, but the speed of the exit is the crypto part. Stablecoins made the money portable within hours, and exchange freezes are the main brake. Watch how much Arkéa recovers and whether its service provider is named.