- Crédit Mutuel Arkéa has confirmed a cyberattack that allowed what it called “fraudulent operations”. It has since resumed customer transfers, and still has not put a figure on what was taken.
- The investigator ZachXBT named the bank as the victim of a $133m crypto theft, roughly $108.8m of it moving in the USDC.
- Reporting on the bank’s account says attackers used Arkéa’s own account through a payment provider’s platform. It makes no mention of crypto, and the two accounts have not been publicly joined up.
A French bank has confirmed it was attacked. A investigator says that attack cost $133m in cryptocurrency. Those are two claims from two very different kinds of source, and in public, nobody has yet connected one to the other.
Large theft figures almost always arrive before anyone has confirmed whose money went missing. In this case there is a bank admitting it was attacked, and a dollar total assembled by watching funds move across public ledgers. They may well describe the same event. Only one of them has been confirmed by the party that would actually know.
And if you have ever wondered why stolen crypto sometimes comes back and usually doesn’t, the answer is in the second half of this story: recovery depends almost entirely on where the money stops moving, and how fast.
What the bank has actually said
Crédit Mutuel Arkéa, a cooperative banking group based in Brest in Brittany, confirmed it had been the target of a cyberattack. Its statement said the attack allowed “fraudulent operations” to take place, and that the group was still working out how much had been taken.
That wording covers a lot of ground. Fraudulent operations could mean transfers, trades, withdrawals or something else again. The statement does not mention cryptocurrency, stablecoins, or any exchange.
More detail has since emerged about the route in. According to CryptoSlate, the attackers operated through the bank’s own account on a payment provider’s platform, rather than breaking anything at the bank itself. Arkéa has also resumed customer transfers, which suggests it believes the immediate problem is contained, though resuming normal service says nothing about the size of the loss.
No figure has come from the bank at all. “Still assessing the amounts” is the normal position in the first days after an intrusion, and it is usually accurate rather than evasive, because reconciling what moved and what was authorised takes longer than people expect.
Where the $133m figure comes from
The number comes from ZachXBT, a pseudonymous blockchain investigator whose tracing work is regularly picked up by the major crypto outlets. He named the bank as the victim of a theft totalling around $133m, with roughly $108.8m of it moving in USDC, a dollar-pegged stablecoin issued by the American firm Circle.
Tracing of this kind follows money rather than people. Every transfer on a public blockchain is visible to anyone, so an investigator can watch a large sum leave one address, split across others, and head towards exchanges or swap services. The movements are a matter of record.
Whose money it was is a separate question. Attribution to a specific victim comes from somewhere off the chain: a tip, a timeline that matches a known incident, an address previously associated with an institution. Where that reasoning isn’t published, outsiders have no way to check it. So the trail is evidence of a theft. It is not, on its own, proof of who was robbed.
One sourcing note, said once: we worked from Decrypt’s report, and from CryptoSlate for the later developments. We could not locate the bank’s own statement or the investigator’s original post, so the quote and the figures here are as those outlets relayed them.
Why a bank would be holding crypto on an exchange
It sounds odd that a retail banking group would have nine figures of stablecoins sitting anywhere near an exchange. It is fairly ordinary, though, for any institution with a digital asset desk. You cannot trade on an exchange without funds already on it, and firms that make markets or service clients keep working balances parked there for exactly that reason.
Those balances are controlled by login credentials, API keys and internal approval processes. Compromise the systems holding those, and nothing cryptographic has to be broken. The attacker simply uses the institution’s own access, which is why most very large crypto thefts are corporate intrusions rather than anything exotic. The account of this attack, an intruder moving money through Arkéa’s own account on somebody else’s platform, fits that pattern, whatever the eventual figure turns out to be.
The same logic applies at a much smaller scale to anyone keeping coins on an exchange account, which is the argument behind holding your own keys, with all the trade-offs that brings.
What a freeze can and cannot recover
Stablecoins are the one corner of crypto where an outside party can intervene. Circle can blacklist a USDC address, which leaves the sitting there but makes them impossible to move or redeem. Exchanges can freeze accounts when stolen funds land on them and someone spots it in time.
Both depend on speed. Funds swapped into bitcoin or ether, pushed through a mixing service, or bridged to another network leave no issuer to call and no account to lock. The share of stolen crypto that gets recovered tends to be the share that was still in a freezable form when somebody raised the alarm.
What to watch
Whether the bank puts a number on the loss. Transfers running again is an operational milestone rather than an accounting one, and a group this size reports to French regulators and publishes accounts, so a confirmed crypto loss would eventually have to appear somewhere more formal than a press statement.
Whether the payment provider is named, and whether it offers its own version of what happened. Two parties describing the same breach is usually how the detail arrives.
And whether any of the tracked USDC gets blacklisted. A freeze is a public, on-chain event that anyone can verify, and it would be the first hard link between the money trail and the incident the bank has admitted to.