In the Crédit Mutuel Arkéa cyberattack, attackers entered through a supplier’s platform and sent money from the bank’s own account. The bank confirms the attack. Outside trackers put the haul near $133 million, and say most of it went into crypto.
What Happened in the Crédit Mutuel Arkéa Cyberattack?
The French banking group says attackers entered through an unnamed service provider’s platform, reached its systems directly, and used its proprietary account to wire funds to other banks. On November 4, it confirmed a “sophisticated” attack, paused some transfers, and alerted regulators. Paris prosecutors have opened an inquiry.
Onchain data fills in the rest. From midday on November 1, about $126 million in USDC left accounts at Kraken, Crypto.com and OKX for 17 wallets in roughly 28 hours. Within four hours, $63 million of it had been swapped into 27,553 ETH.
From a supplier’s login to Monero
What the bank confirms, what the blockchain shows, and the link nobody can prove yet.
An unnamed service provider’s platform is the way in.
Attackers reach Arkéa’s systems directly.
Its proprietary account, not customer money.
About $133M by outside counts. The bank confirms the order of magnitude.
Kraken, Crypto.com and OKX pay out about $126M in USDC.
Paid over roughly 28 hours from midday November 1.
$63M swapped within about four hours.
Bridged, swapped and pushed through Monero across 526 wallets.
What We Still Don’t Know
The bank confirms only the order of magnitude of the $133 million (€118 million) figure. It hasn’t named the supplier or said how access was gained, denies that its online bank, Fortuneo, was the way in, and rules out internal error. Blockchain records alone can’t prove the bank-to-exchange link either.
What’s the Impact?
The bank says customer money is untouched and its finances aren’t at risk. Recovery is harder. Tether froze 1.14 million USDT, and Crypto.com and OKX blocked funds or accounts. By November 5, the thieves still held about $37 million. Most of the rest was bridged, swapped or pushed through Monero.
$126M out. $1.14M frozen.
The Part That Should Worry Every Bank
Twelve of the 17 receiving wallets had taken exchange payouts before the theft; the oldest was from May. Someone built the cash-out route months before the first transfer. And the investigator who first flagged the theft says more than $30 million slipped away that a faster public warning could have frozen.
Months of setup, one weekend to cash out
- May 2026The route is ready
The oldest of the receiving wallets starts taking exchange payouts. Twelve of the 17 have history before the theft.
- November 1, middayThe USDC starts moving
Kraken, Crypto.com and OKX accounts begin paying out to 17 wallets.
- Within four hours$63M becomes 27,553 ETH
Stablecoins are swapped before freeze requests can land.
- November 2Tether freezes 1.14M USDT
About $126M has left exchange accounts over roughly 28 hours.
- November 4The bank confirms the attack
Arkéa calls it sophisticated, pauses some transfers and alerts regulators.
- November 5$37M still onchain
The rest is spread across 526 wallets, bridges and Monero.
How to Avoid This
- Treat any supplier platform that can reach payments as part of your payment system, with the same MFA, logging, and least privilege.
- Cap outflow from your own accounts across every channel and over several days, and hold payments to new beneficiaries for a human.
- Run the test: can a supplier’s account pay a beneficiary you’ve never paid?
- Alert on bursts of large transfers into exchange and payment firm accounts.
- Share beneficiary and wallet details with exchanges and stablecoin issuers within hours.
Published IOCs
Analysts have published more than 20 Ethereum addresses tied to the cash-out, including the wallet that bought the ETH and the one Tether froze. The full list is in the IOC table below.
Ethereum addresses tied to the cash out
| # | Address | Role |
|---|---|---|
| 1 | 0x730bcb1296758c377149d7409f98f041cf723992 | Attacker Oldest receiving wallet, in use since May 4 |
| 2 | 0x90f0b6d51ed2fe2348a45b2c49bc441e959bc557 | Attacker Receiving wallet, took $858K from Kraken in October |
| 3 | 0xe944f94a773027d5ca80806955dc670e587a8cb9 | Attacker Receiving wallet, $9.67M |
| 4 | 0xd3c1cda4d49fe4280a94b43c92a2e4acf530a7c1 | Attacker Receiving wallet, $7.74M |
| 5 | 0x3e6c3d135ca8f8be793e5fe1715ce6c057d140f2 | Attacker Receiving wallet, $5.34M |
| 6 | 0x99d314e6970b8d3db0dbe6f6e041cc904143400f | Attacker Receiving wallet, $5.25M |
| 7 | 0x5cf70edce65847ef989933c3072fb0e7f335abc1 | Attacker Receiving wallet, $8.52M from Kraken on November 2 |
| 8 | 0xe378cdccb369a64a0190577787ef61ca2eefa6b2 | Attacker Receiving wallet, $8.73M from Kraken on November 2 |
| 9 | 0x9eca05d78f6751c91ab048858b7d21a67c015547 | Attacker Swap wallet that bought the 27,553 ETH |
| 10 | 0x65c33571ca72885637076b84db517809c16eb841 | Attacker Largest ETH stash on November 2, later split |
| 11 | 0xa3a98584d410c4e32f9825f6af1168f4e774ae0d | Attacker Wallet holding the USDT Tether froze |
| 12 | 0x18ec8239cbd3062289e4bd514250d14bdd426413 | Attacker ETH stash, first funded November 2 |
| 13 | 0x448cdc9b813d3bdeabcc07a922ac4e06aaa97337 | Attacker ETH stash, first funded November 2 |
| 14 | 0x2f5e296bbf152e879b76cbd501ff0efb466ab904 | Attacker Holds 4.14M DAI |
| 15 | 0x18cd13416793e140345d87ec69e12841647a1939 | Attacker Holds 1.70M USDC |
| 16 | 0x94dc65f1f9ff552d6b61d5560eae0f43ae4c06f0 | Attacker Hub wallet active since December 2025, swapped USDC to ETH on November 3 |
| 17 | 0xf19b12578f7c2820c87b4b7c35ab2e2bdf8a617a | Attacker Swapped 2,478 ETH into DAI on November 5 |
| 18 | 0xbb2a25a0918290c501f793ed12425b3b0854295a | Watch KuCoin deposit address, largest exchange exit |
| 19 | 0xfa6766b362461a20046451b16277ec5f7d159556 | Watch Kraken deposit address, received 396 ETH on November 3 |
Behavior to hunt for
- Bursts of large outbound transfers from the bank’s own accounts to new beneficiaries at exchanges or payment firms
- Supplier or service accounts starting payments they have never made before
- Payments split across several days or channels that stay under single transfer limits
- Stablecoin withdrawals to fresh wallets followed by fast swaps into ETH
Your Supplier Can Move Your Money. Has Anyone Tested That?
Nobody plans for a vendor login to reach the payment rails, so nobody checks. Secure.com puts governed AI Teammates on that grunt work while your team keeps the final call.
- Red Teammate tests whether supplier access can reach your payment systems, within the scope you approve, then hands defenders the path to close.
- SOC Teammate tracks outflow from your own accounts across systems and days, and escalates odd bursts to a person.
- Cloud Teammate flags vendor connections with more reach than they need.
- GRC Teammate maps third-party controls to evidence for DORA reviews.
- Big moves wait for human approval. Attack. Harden. Prove. Repeat.
The Bottom Line
The bank’s alarms worked during the Crédit Mutuel Arkéa cyberattack. The money still left, and crypto moved faster than any freeze request. Find out what a supplier login can do to your money before an attacker runs that test for you.