Worked example · 2026-11
Crédit Mutuel Arkéa — attackers reached the bank's own account through a service provider's platform and wired about $133M to crypto exchange accounts, then withdrew stablecoins — Crédit Mutuel Arkéa (French bank) / Ethereum and exchange accounts — 2026-11-01
Summary
On 2026-11-01 stablecoins worth $106M+ were withdrawn from several centralized exchange accounts. ZachXBT flagged it on 2026-11-02 as an unnamed EU entity, raised it to $133M+ on 11-03 with the working theory that "a large financial institution in Western Europe was exploited and it's currently being covered up", and on 11-04 named Crédit Mutuel Arkéa, "allegedly". The bank confirmed a cyberattack to AFP on 11-04 and published a statement that evening: attackers used a service provider's platform to reach the bank's own account and sent payments to other banking actors, which "potentially" let them convert the money to crypto through specialised platforms; no customer account or subsidiary was used; the incident is "contained". Secondary press (dcod, citing Presse-citron) adds that the payments went to exchange accounts opened under false identities; the bank has not said so. The provider is not named and the technical access is undisclosed.
Timeline (UTC)
Read it as four stages. Get in: through a provider platform to the bank's own account (undisclosed). Cash out: payments to exchange accounts, then USDC and USDT withdrawn on-chain. Launder: consolidation wallets, ETH, instant exchanges, Monero, bridges. Respond: bank statement, investigation, exchange freezes. Wallet times are from Blockscout (OAK). Fiat-leg and response times are from the sources cited.
| When | What happened | OAK |
|---|---|---|
| Before 2026-11-01 (undisclosed) | Entry. Attackers get access through "the platform of a service provider" and reach the bank's own account. The provider, the access method and the dwell time are not published ([arkeastatement2026]). |
T15.002 (inferred) |
| 2026-10-23 12:54:47 | An earlier, smaller withdrawal: 105,971.27 USDC from the common source contract to listed address 0x90f0b6d51ed2fe2348a45b2c49bc441e959bc557 (0x5762ad755d994728e68e5b8531e7834e1bc221eeb110d955d405bf19d0ed4d30). 102,138 USDC leave it four minutes later. Whether this was a test is not known; OAK only notes the address is on ZachXBT's list. |
— |
| Before 11-01 (undisclosed) | Fiat leg. The bank's own account sends transfers to other banks, "which then potentially allowed them to convert this money into cryptocurrency via specialised platforms" ([arkeastatement2026]). dcod, citing Presse-citron, says the beneficiaries were exchange accounts opened under false identities (secondary, not confirmed by the bank). ZachXBT: the attack ran "for multiple days". |
T15.002 → cash-out |
| 11-01 16:35 → 22:32 | Stablecoin withdrawals. The common source contract 0x2744dfd9898f0babbc570cc594bbbc84b487a22b pays USDC to ten of ZachXBT's listed addresses in lots of about 3.4M to 9.8M. Examples: 3,805,671 USDC to 0x5a154f77852ed274fd6f4c324a1ee27809052ff7 at 16:40:23; 9,806,638.62 USDC to 0xadd95cd98e0288ba69785e3151e1db86adf8dd58 at 20:08:11, in 0x8d03a4c9ca5068dedf3a06cd5d9794464182f24fde2de1c57ef92e9fb8cac831; 9,582,349.79 USDC to 0x730bcb1296758c377149d7409f98f041cf723992 at 22:04:23. OAK did not identify the operator of the source contract; ZachXBT says the withdrawals came from "multiple centralized exchange accounts". |
T15.002 → cash-out |
| 11-01 18:52 → 20:23 | Fast onward hops. Within minutes each address forwards the full amount: 0xadd95cd98e0288ba69785e3151e1db86adf8dd58 sends 9,807,638.616795 USDC to hop wallet 0x7f2366116d0e193fbae83a930a70d2473d8520d6 at 20:11:11 (0x10774978d94bdcf5534a9cf4a3ca739c9943183338d06d267360a7afe66798e2); 0x12d9012731eb0d54871a31af5566eb9ecca351db and 0x730bcb1296758c377149d7409f98f041cf723992 both pay the consolidation wallet 0xc80f1cd39dc15a341c4ff083ece7d526964a8ce4. Hop wallets split into lots of 4.4M to 5.4M and meet again at 0x16f70a1bf5d49e2d18c1eb4ae3343baa05e3c3ac. |
— |
| 11-01 (during the theft) | Address poisoning around the wallets. Right after many of these transfers, near-identical transfers of the same amount go to addresses that share the first and last characters of the real recipient (for example 0x16f9ce901782d8ec9455bdf07b8b78af06e3c3ac beside 0x16f70a1bf5d49e2d18c1eb4ae3343baa05e3c3ac). OAK followed only the earlier transfer of each pair. |
— |
| 11-02 02:46 → 03:01 | 0x16f70a1bf5d49e2d18c1eb4ae3343baa05e3c3ac sends lots of 1.78M to 2.04M USDC to contract 0x9ec7d953255bfd805d9451ec105e21b672015547, first lot in 0xac44f9df42f2e0e8751f9ddf06d5f80703219e1279c563f2d052f040c9a4f9b8. OAK did not identify this contract. |
T7.003 / T7.005 (likely, unverified) |
| 11-01 → 11-02 | Laundering (ZachXBT, 11-02): "aggressively swapping USDC for ETH, transferring to instant exchanges (WellWallet, Kyrrex, etc), converting to XMR via Wagyu, and bridging across multiple chains" ([zachxbt372]). |
T7.005 / T7.003 |
| 11-02 12:28 | ZachXBT's first alert: an EU entity suspected of losing $106M+ from multiple CEX accounts on 11-01; 11 theft addresses ([zachxbt372]). |
response |
| 11-03 07:31 | Update: $27M+ more CEX withdrawals, total $133M+; theory that a large Western European financial institution was exploited and "covered up"; $30M+ already laundered that could have been frozen; four more theft addresses ([zachxbt374]). |
response |
| 11-04 (Wednesday) | The bank confirms a cyberattack to AFP; ZachXBT names it at 02:24 ([zachxbt375]). Kraken restricts linked accounts and Crypto.com blocks funds (Clubic, citing ZachXBT). Transfers are suspended and "almost all operations" resume by the morning. |
response |
| 11-04 evening | Bank statement: attackers used its own account via a provider platform, not Fortuneo, not customer accounts; "sophisticated attack from outside"; no human error at Arkéa; amount "still being assessed"; part of the funds blocked ([arkeastatement2026], [clubic2026], [journalducoin2026]). The Paris prosecutor's cybercrime unit opens an investigation (as relayed by Security Affairs). |
response |
Key addresses (all are on ZachXBT's lists unless marked as hops found by OAK):
- Common USDC source for ten of the fifteen listed addresses (operator not identified):
0x2744dfd9898f0babbc570cc594bbbc84b487a22b - First list (11-02):
0xADd95cD98E0288ba69785E3151E1db86adF8Dd58,0x29e9D7715D935e0D0D4B0DD0efC952A97E551020,0x378B4f150707C283574DC89739608D29036D57d5,0x795a9d22F233024487161Fe6daFf73397c162621,0x730Bcb1296758c377149d7409f98f041cf723992,0x12D9012731eb0D54871A31Af5566Eb9ECCa351Db,0x5A154f77852ed274Fd6F4c324a1Ee27809052FF7,0xA1096A66f9ed58A9594A6A1ad67A5472C0907224,0x90F0b6D51ed2FE2348A45b2C49BC441E959bc557,0x8A97BC406180e28b11C5495fA099BF5119c6C6B0,0xd010cba790a6ab0048da18f2fbe8e3faf463a16a - Second list (11-03):
0x5cf70edce65847ef989933c3072fb0e7f335abc1,0xe378cdccb369a64a0190577787ef61ca2eefa6b2,0x3e6c3d135ca8f8be793e5fe1715ce6c057d140f2,0x99d314e6970b8d3db0dbe6f6e041cc904143400f - Hops found by OAK:
0x7f2366116d0e193fbae83a930a70d2473d8520d6,0x4a05b9f4c9385388eb27588951ddbf2916b5daf3,0xc80f1cd39dc15a341c4ff083ece7d526964a8ce4,0xe0f0c1aff99879ccd594abd6fe10452cbb010b0c,0x16f70a1bf5d49e2d18c1eb4ae3343baa05e3c3ac,0xb4043516a2e5c20e6227ea074c4112457d06d39b
Fund flow
Traced by OAK on 2026-11-10 with Blockscout (the Ethereum USDC leg only). Each edge is the first, earlier transfer of an amount; the near-duplicate transfers to lookalike addresses that follow are address poisoning and are not hops. The fiat leg from the bank, the exchange accounts, the ETH, bridge and Monero hops and the final holders are not traced; the source contract and hop destinations are unlabeled.
All transfers as a table (19)
What is not known yet
- How the attackers got into the provider platform and which provider it is: undisclosed. Press reports that the payments started at Fortuneo are denied by the bank.
- How the payments left the bank (which rail, which beneficiary banks) and whether the exchange accounts were opened under false identities: the bank says only "other banking actors" and "specialised platforms"; the false-identity claim is secondary (dcod).
- Final loss: ~$133M+ (ZachXBT), about 118M euros (Le Télégramme via Clubic) or about €100M (Reuters via Security Affairs). The bank has not published a figure.
- Which exchanges held the accounts, beyond Kraken and Crypto.com acting on linked accounts, and who operates the common source contract: not identified by OAK.
- What was recovered: the bank says part was blocked, with no amount.
Root-cause evidence
- Technique: OAK-T15.002
- Source: https://t.me/investigations/375; https://www.clubic.com/actualite-637615-fortuneo-victime-d-une-fraude-les-clients-a-l-abri-mais-des-millions-d-euros-auraient-ete-detournes.html; https://journalducoin.com/actualites/cyberattaque-credit-mutuel-arkea-confirme-fortuneo-clients-epargnes/
- Source type: news
- Confidence: reported
- Evidence: The operator-side facts come from the bank's 2026-11-04 statement as relayed by Clubic, Journal du Coin and Boursier.com (OAK could not open the statement itself): attackers passed through a service provider's platform, used the bank's own account to send payments to other banking actors, and did not touch customer accounts or Fortuneo. No source says how the provider platform was breached or abused, so T15.002 is OAK's closest fit for "attackers entered through a third party's platform", not a finding. The on-chain leg (the withdrawals and hops above) is OAK's own trace and is independent of the entry. Same-week reporting is not settled; the bank's account is the official version and the amount is unconfirmed.
Public references
[zachxbt372]— ZachXBT, Telegram @investigations post 372 (2026-11-02 12:28 UTC), first alert with 11 theft addresses: https://t.me/investigations/372[zachxbt374]— ZachXBT, Telegram @investigations post 374 (2026-11-03 07:31 UTC), $133M+ update with 4 further addresses: https://t.me/investigations/374[zachxbt375]— ZachXBT, Telegram @investigations post 375 (2026-11-04 02:24 UTC), names Crédit Mutuel Arkéa: https://t.me/investigations/375[arkeastatement2026]— Crédit Mutuel Arkéa statement of 2026-11-04, as reported by Boursier.com, "Crédit Mutuel Arkéa fait un nouveau point sur la cyberattaque": https://bourse.fortuneo.fr/actualites/banques-credit-mutuel-arkea-fait-un-nouveau-point-sur-la-cyberattaque-6453398[clubic2026]— Clubic, "Cyberattaque au Crédit Mutuel Arkéa : plus de 100 millions d'euros détournés via un prestataire" (2026-11-04, updated 11-05): https://www.clubic.com/actualite-637615-fortuneo-victime-d-une-fraude-les-clients-a-l-abri-mais-des-millions-d-euros-auraient-ete-detournes.html[journalducoin2026]— Journal du Coin, "Cyberattaque Crédit Mutuel Arkéa : Fortuneo hors de cause" (2026-11-04): https://journalducoin.com/actualites/cyberattaque-credit-mutuel-arkea-confirme-fortuneo-clients-epargnes/[securityaffairs2026]— Security Affairs, "Attackers Exploit Third-Party Provider to Raid French Bank Crédit Mutuel Arkéa" (2026-11-08), relaying Reuters and BleepingComputer: https://securityaffairs.com/202628/cyber-crime/attackers-exploit-third-party-provider-to-raid-french-bank-credit-mutuel-arkea.html[dcod2026]— dcod.ch, "Crédit Mutuel Arkéa subit un vol de 133 millions de dollars" (2026-11-09, secondary): https://dcod.ch/2026/11/09/credit-mutuel-arkea-vol-133-millions-dollars/