Arkéa Theft: The Bank Account and Crypto-Tracing Claims

Crédit Mutuel Arkéa confirms that attackers used the bank's own account to transfer money to other banks. Cryptocurrency tracing reports describe what investigators believe happened afterward. Those accounts concern different stages of a suspected theft. Connecting those stages requires evidence that neither account supplies in full.

The bank's explanation also contradicts an early claim about the entry point. Its November 4, 2026 clarification explicitly excludes Fortuneo as the route of entry.

The bank's confirmed public account

Arkéa attributes the intrusion to a third-party provider's platform. It says the transfers used its own account, that customer accounts were not the source, and that customers' assets suffered no financial consequence. It describes the incident as contained, with temporary payment delays and most operations restored.

These are the bank's statements about its incident. They are not an independent audit of every affected system. The bank says police and judicial authorities are investigating.

Asked about figures of €118 million and $133 million, Arkéa did not confirm those exact amounts. It accepted the approximate scale. The public explanation describes a possible later conversion into cryptocurrency but does not establish a Monero-specific destination or transaction path.

The blockchain investigation and its limits

Bitquery's investigation, with figures dated November 5, describes $126.04 million in USDC withdrawals from Kraken, Crypto.com and OKX to 17 wallets. It traces onward activity on Ethereum and distinguishes its count from a larger figure attributed to ZachXBT.

Bitquery acknowledges that it cannot explain the gap between its total, the investigator's figure and the bank's initial estimate. Its narrative combines visible transfers with attribution of addresses to the suspected theft. That attribution is part of the investigation, not a fact supplied by every blockchain transaction itself.

This article has not independently reproduced the address clustering or reconciled it with bank records. The total remains an attributed research finding. A withdrawal from an exchange also does not establish that the exchange itself was hacked.

A visible transfer does not identify every participant

A public ledger can record that one address sent an asset to another. Explaining whose money it was, who controlled an account and why a payment occurred often requires evidence outside that ledger.

An exchange withdrawal and a bank transfer can have different timestamps, currencies and fees. Matching amounts alone cannot establish that they represent the same funds. Investigators may have account records or other evidence that is unavailable to readers. A published chart should make clear which links it demonstrates and which it infers.

The same caution applies to totals. Adding every onward movement can count the same funds repeatedly. A total of initial withdrawals, a balance remaining at a later time and an estimate of the victim's loss answer different questions. They are not interchangeable measures.

No independently substantiated Monero-specific tracing claim was established in this review. We have omitted that allegation rather than turning a reported destination into evidence that Monero transactions were traced through the protocol.

Questions for the incident investigation

For the bank and its provider, the unanswered technical questions include which access controls failed, how payment authority was obtained and how recovery is proceeding. The reviewed statements leave those questions open.

For readers comparing privacy services, this is a reminder to separate account access, custody and network records. Our guide to offline Monero wallets deals with protecting spending keys. It does not make claims about preventing an institution's payment-system compromise.

Customers should use the bank's established channels for account-specific information. A message citing a real theft is not, by itself, a trustworthy instruction to transfer money or reveal credentials.

Research checked November 9, 2026 UTC. The bank's exact loss, complete attack mechanism and independently reconciled crypto trail remained unresolved in the sources reviewed.