At 13:25 on Sunday, November 1, a wallet created that same day received 48,900 USDC from OKX. It was All Saints' Day, and every bank branch in France was closed. Kraken withdrawals followed that afternoon. From 16:33 they climbed from US$49,000 toward US$100,000 apiece, and by 17:20 several accounts were withdrawing in parallel.
At 21:06, one address received a US$1,000 test payment. Two minutes later, the same address received about US$9.8 million. The pattern repeated until shortly before 23:00. By midnight, about US$105 million in USDC had left three exchanges, according to a minute-by-minute blockchain reconstruction by Benjamin Charles of the Zero Bullshit newsletter. Another US$24 million followed on Monday.
None of the money belonged to the exchanges or their customers. It belonged to Crédit Mutuel Arkéa, a cooperative banking group based near Brest with €211.5 billion in total assets, according to The Block. The bank says its systems flagged the activity quickly. Its first public word on the theft came on Wednesday, November 4, three days after the first withdrawal.
The first person to describe the theft publicly worked for neither the bank, its supervisor, nor the police. On November 2, the pseudonymous blockchain investigator ZachXBT told his Telegram channel an unnamed EU entity had lost more than US$106 million through withdrawals from centralized exchange accounts. A day later he raised the figure above US$133 million, and late on November 3, US Eastern time, he named Crédit Mutuel Arkéa as the alleged victim. By then the money had already been through Ethereum, Tron, Arbitrum, and Monero.
What Arkéa Confirms and What It Withholds
Arkéa first confirmed the attack to AFP on the morning of November 4, issued a press release at 13:00, and published a fuller question-and-answer statement later that day. The bank describes an attack enabling fraudulent transactions and calls it a sophisticated attack from outside, now contained. It rules out human error. The attackers, it says, went through the platform of one of its service providers and reached Crédit Mutuel Arkéa directly.
The mechanism Arkéa describes is narrow and specific. The attackers used the bank's own account, its treasury rather than any customer account, to send transactions to other banking institutions. Those transactions, the bank says, may have allowed the money to be converted into cryptocurrency on specialized platforms. No accounts belonging to its federations or subsidiaries were used, and customer holdings were untouched apart from some delayed transfers.
The bank also contested early press accounts. The journalist Grégory Raymond and Le Figaro had placed the origin of the transfers at Fortuneo, Arkéa's online banking subsidiary. Arkéa answered directly, stating no entry came through Fortuneo and the attackers reached Crédit Mutuel Arkéa through a provider's platform.
On the amount, Arkéa will not confirm the €118 million (US$133 million) figure circulating in the press. It validates only the order of magnitude, and says the sum poses no threat to Arkéa's financial strength. That reassurance echoes Binance's survival of a far larger theft on the strength of its balance sheet. Like Binance's, it addresses solvency and says nothing about how the money left. Part of the funds was blocked, and recovery efforts continue.
On November 6, Daniel Baal, president of the Confédération nationale du Crédit Mutuel, told France 5 the losses exceed €100 million and part of the money had been recovered. He gave no figure and said he could not tell whether the attack was run from France or abroad.
The cyber crime section of the Paris prosecutor's office received a complaint from Arkéa on the morning of November 4 and opened an investigation into organized-gang intrusion into an automated data processing system. The investigation sits with the French National Police's Office anticybercriminalité (OFAC).
Everything else remains withheld. Arkéa has not named the provider, described what the provider's platform does, explained how the attackers obtained the ability to move treasury funds through it, or said when it first detected the fraud. The initial access into the provider is undisclosed. Every analysis of this heist, ours included, works inside those gaps.
Competing Explanations for One Theft
Two models of the money flow circulated in the first 72 hours, and they lead to very different conclusions about what failed.
Model 1, Compromised Bank-Owned Exchange Accounts. ZachXBT's first description spoke of losses from multiple centralized exchange accounts, and Bitquery found 11 of the 15 receiving wallets it identified had received funds from the same exchanges as early as May. Early readings treated those wallets as allowlisted withdrawal addresses, which would mean the attackers took over accounts the victim itself held at Kraken, Crypto.com, and OKX. Arkéa did apply in May for authorization to offer crypto-asset services, according to ZATAZ, though ZATAZ found no link between the application and the attack.
Model 2, Wire-Funded Accounts Under False Identities. Raymond's sources, reported by Actu17, describe euro transfers into exchange accounts opened under false identities, each transfer carrying the exact name of the receiving account holder. Those accounts were funded rather than hacked. Their identities passed the exchanges' know-your-customer (KYC) checks.
The evidence favors Model 2. Kraken said its systems were not compromised and no customer account was taken over, a statement difficult to reconcile with a takeover of the bank's own exchange accounts. Arkéa's account of transactions sent from its treasury to other banking institutions describes outbound wires, and wires need somewhere to land.
Charles's sources close to the exchanges say at least two of the identities were fake, assembled from recent data breaches, though he could not verify the claim directly. Breached identity data is plentiful raw material, as the alleged sale of more than 153 million driver's license records traced to identity vendor IDScan shows. assess with moderate confidence the attackers moved euros from Arkéa's treasury into exchange accounts controlled by the fraud network, bought USDC there, and withdrew it to wallets they controlled.
Since October 9, 2025, the EU's Instant Payments Regulation has required payment service providers in euro-area member states to offer Verification of Payee, a check comparing the beneficiary name on a euro transfer against the name on the receiving bank account. The check warns the payer of a mismatch but does not necessarily stop the payment.
Cryptocurrency exchanges run their own checks on the relationship between the funding bank account and the customer's verified identity. Matching names could have helped satisfy either control, but the payment instructions and screening results remain unpublished. Business customers submitting payments in bulk can also opt out of Verification of Payee under the same regulation. Whether Arkéa's treasury transfers passed through either check, and what those checks returned, is unknown.
The access vector behind those transfers is a separate question, and three hypotheses fit the public record.
Hypothesis 1, Compromised Provider Platform With Payment Rights. The bank's own account points here. A provider platform holding authority to initiate treasury transfers, once compromised, lets an adversary issue payments the bank's systems treat as legitimate. Frédéric Ocana, a cyber security specialist interviewed by Cryptoast, framed the risk as an attacker compromising a provider's platform or its credentials and then acting under an identity the bank recognizes as authorized. This hypothesis is consistent with every statement Arkéa has made, and I assess it as the most likely explanation, with moderate confidence.
Hypothesis 2, Compromised Access of a Provider-Side Individual. Charles reports his sources converge on an external person holding access on Fortuneo's behalf, whose access may have been compromised, while noting the sources contradict one another. This hypothesis overlaps with the first, since a provider platform is operated by people with credentials. It strains against Arkéa's denial of any Fortuneo entry, unless the bank and the reporters define "entry" differently. I give it low confidence until the provider is identified.
Hypothesis 3, Social Engineering Modeled on CEO Fraud. One of Raymond's sources favored human manipulation, a variant of the fraud the French call arnaque au président, over a technical intrusion. Persuasion has already moved data and money at scale this year, from a fraudster impersonating a government agency to extract Revolut customer records to the voice-phishing campaign ShinyHunters claims against McKesson.
Arkéa's exclusion of human error is the strongest evidence against it. That exclusion is narrower than it sounds, however. A bank can rule out error by its own staff while a provider's employee is deceived, and a deceived employee at a third party fits the bank's phrase "an attack from outside" without contradiction. I assess this hypothesis with low confidence, but the bank's statements do not eliminate it.
The three hypotheses share one feature. In each, the adversary acts through access the bank already trusted. The same pattern drove the theft of 8.8 million Danish identities through one company's legitimate CPR access, and PLUMP SPIDER (aka Breeze Comet) pushes fraud through Brazil's real payment rails by compromising the banking software allowed to use them.
Six Months of Preparation for One Holiday Weekend
Whatever the access vector, the cash-out infrastructure was not improvised. Charles found 12 of his 18 receiving wallets active from the spring, with 132 withdrawals worth US$2.34 million from Kraken and Crypto.com between May and October. Five of the six largest receiving addresses of November 1 had received funds between May and September. The repeated withdrawals are consistent with account warming, in which a fraud network builds transaction history to move larger sums later. Only the exchanges can confirm whether withdrawal limits actually rose, or whether the same people controlled these accounts throughout.
The supporting infrastructure goes back further. A wallet created in late December 2025 received US$6.9 million of the stolen funds and sits at the center of the network, according to Charles. A single fee-paying address, active since August 2025, paid network fees for 38 wallets in the network from August 31 through November 4, before and during the theft. Ten of the 18 receiving wallets used a Trust Wallet smart-account feature allowing another address to pay their transaction fees.
Charles notes the May to October withdrawals fell between 07:12 and 21:43 Paris time, 107 of 132 on weekdays, a working-hours rhythm consistent with a threat actor in or near a European time zone.
The theft itself began on a Sunday public holiday. Holiday and weekend timing is old bank-heist tradecraft. In February 2016, North Korea's STARDUST CHOLLIMA (aka Bluenoroff) issued fraudulent SWIFT instructions against Bangladesh Bank while its offices were closed for the weekend, eventually stealing US$81 million in a theft the US Department of Justice later charged against North Korean programmer Park Jin Hyok. The stop-payment requests reached the Philippine bank holding the receiving accounts a day late because of Chinese New Year. Those receiving accounts at RCBC had been opened under fictitious names in May 2015, nine months before they were used.
The parallel stops at tradecraft. ZachXBT has said he holds a high degree of confidence the Arkéa theft has no link to any North Korean threat actor, according to The Block, and nothing in the public record contradicts him.
The contrast with PRESSURE CHOLLIMA's US$6.34 billion Binance heist days earlier is rather intriguing. That operation turned a fake job interview and Binance's own tooling into a drain lasting roughly twenty minutes. Arkéa's thieves spent months building a laundering network sized for a nine-figure theft, then needed a full day of withdrawals to empty it. Charles found no confirmed link between the two thefts or the Chainalysis breach disclosed at the end of October.
No threat actor has claimed the heist, and no authority has attributed it. One of Raymond's sources pointed to Franco-Israeli fraud networks which industrialized CEO fraud in the 2010s. The claim rests on a single anonymous source and no published evidence, and I assess it with low confidence.
The apparent months of account preparation, the identity fraud sufficient to pass exchange onboarding, and the parallel withdrawal activity point to an organized eCrime threat actor with mature cash-out capability. As I argued in my analysis of attribution as a confidence judgment, a recognizable modus operandi narrows the field without naming the adversary.
Charles also flags how much the blockchain cannot reveal. The bulk-withdrawal nights showed several streams of activity running at once, inconsistent with one person at a keyboard. Whether those streams were multiple people or scheduled programs, the chain does not say.
Racing the Freeze Window
The choice of USDC looks like a mistake at first. Circle and Tether can freeze stablecoins at the contract level, which makes them among the most seizable assets in crypto. They are also the fastest route from a euro deposit to an asset movable on-chain, and the threat actor treated the freezable phase as a window to close quickly.
The conversion started the first night. About US$63 million in stablecoins became 27,553 ETH through UniswapX in roughly four hours between Sunday night and Monday morning, according to Bitquery, beyond the reach of any issuer freeze.
Charles traced another US$3.25 million swapped into DAI, which no issuer can freeze, and US$14.25 million deposited on Hyperliquid and converted to Monero. About US$40 million in USDT moved to Tron, part of it through the cross-chain services Rango and Bridgers. ZachXBT named the instant exchanges WellWallet and Kyrrex, and Wagyu for Monero conversion, among the services the funds passed through, though ZATAZ notes their appearance does not show any of them knowingly participated.
The freeze record is thin. Around midnight on November 1, about US$95 million remained in freezable form, by Charles's count. By 09:00 Monday, as France returned to work, about US$8 million did. Tether froze US$1.14 million overnight Monday into Tuesday, roughly 35 hours after the first withdrawal, and another US$7.4 million on Tron on November 4 and 5. Circle froze nothing, according to both Charles and Ocana.
By the morning of November 5, Charles counted US$8.6 million frozen, under seven percent of the US$129.6 million he traced. That figure covers only the on-chain freezes visible in his reconstruction. It excludes euro transfers stopped before conversion and anything Arkéa recovered through banking channels, so it does not measure the bank's total recovery.
The exchanges acted, but late. Kraken restricted accounts linked to the theft and said it was working with law enforcement, and Crypto.com blocked related funds. Charles reports Kraken still allowed US$17.2 million to leave on Monday afternoon, about three hours after ZachXBT's public alert, and a receiving address was still being funded from Kraken on the morning of November 5. Kraken has not said when it was first alerted.
ZachXBT counts more than US$133 million, Charles US$129.6 million, and Bitquery US$126 million across 17 wallets, with receiving-wallet counts running from 15 to 18 depending on the analyst and the cut-off. The bank validates only an order of magnitude near €118 million. Each figure measures withdrawals visible on public blockchains, and ZachXBT warns over-the-counter activity could push the real loss higher. Claims of US$600 million to US$1 billion circulated on social media on the strength of a single anonymous post and an unnamed industry source, and no public evidence supports them.
The money trail is now the investigation's most durable asset. As I laid out in my examination of how crypto investigations follow stolen money, every exchange account opened under a false identity left onboarding records, device fingerprints, and IP history behind it. A threat actor capable of months of patient preparation still had to touch regulated platforms to turn euros into tokens.
Disclosure Gap Between Bank and Blockchain
ZachXBT accused Arkéa of failing to file a proper report and argued more than US$30 million could have been frozen had EU law enforcement been alerted sooner. LeBigData and others repeated the charge, and it now frames most public discussion of the heist.
Several facts support it. Most of the freezable value was gone before France returned to work on Monday, and Tether's first freeze arrived around 35 hours after the first withdrawal. The public record places Arkéa's complaint to the Paris prosecutor on the morning of November 4. Kraken continued processing withdrawals hours after a public alert from an outside investigator. Each of those delays sits on the path between detection and freeze.
Other facts cut against it. A bank source told Charles Arkéa alerted its supervisor, the Autorité de contrôle prudentiel et de résolution (ACPR), before the theft became public, and Ocana says Arkéa informed supervisors including the European Central Bank.
The EU's Digital Operational Resilience Act (DORA), applicable since January 17, 2025, governs reporting to supervisors, not to the public. Its implementing rules, set in Commission Delegated Regulation 2025/301, call for initial notification within four hours of classifying an incident as major and no later than 24 hours after becoming aware of it. A bank can satisfy DORA and say nothing publicly for days. Recovery efforts also sometimes favor discretion, since a public alert tells the thief the race has started.
Regulatory reporting and asset freezing run through separate channels. Stablecoin issuers and exchanges freeze on law enforcement requests and their own risk signals, not on confidential notices to a prudential supervisor. A theft converting to ETH within hours of the first withdrawal outruns any process built on formal complaints and regulatory reporting.
ZachXBT's US$30 million estimate cannot be tested from outside, but the direction of his argument is sound. As I argued in my assessment of why knowing about a threat is not the same as stopping it, awareness without a fast path to action buys very little. The fastest freeze path ran through the exchanges and issuers, and the public record shows no evidence the bank used it on Sunday night.
The bank says its systems flagged the suspicious activity quickly. If they did, the question becomes what the alert triggered, and why roughly US$129 million still reached exchange accounts and left them across more than 24 hours. If they did not, the attackers ran treasury transfers of this size through a provider platform without tripping the bank's own payment monitoring. Neither answer reflects well on the controls, and the bank has offered neither.
Trust the Bank to Its Own Machinery
Strip the heist to its visible mechanics. A provider platform became the route into Arkéa's treasury, though the bank has not disclosed what payment authority the attackers exercised through it. Exchange accounts reportedly passed identity checks, and wallets active for months before the theft received the withdrawals. Stablecoins stayed exposed to issuer freezes only until the threat actor converted them overnight. Each stage offered a separate chance to intervene, and most of the publicly traced funds passed through all of them.
Third-party access recurs throughout our tracking this year. Amadeus carried an undetected breach for three years while airlines sent the apologies. Bitget lost US$388 million to valid administrative credentials, and nine flaws in third-party ATM encryption components showed how buried dependencies fail silently downstream. Arkéa extends the pattern into a bank treasury.
Ocana's prescription is the right one, a strict separation between whoever initiates a payment and whoever authorizes it, with independent dual control on large or unusual transfers. Authentication proves a provider is who it claims to be. It says nothing about whether a particular nine-figure payment should leave the treasury.
Daniel Baal said the whole banking sector is now reviewing what could have happened. Guillaume Seligmann, a lawyer at the firm Bersay, told AFP it was the biggest cyber attack ever on a banking institution, a claim impossible to test when so few banks disclose losses of this kind.
Ocana reports other banks have begun auditing their payment systems and the accounts holding extended access rights. Many of those reviews will find a similar structure, because modern banks run on outsourced platforms with access to payment systems. The question for each of them is whether any control sits between that entitlement and a nine-figure transfer on a holiday Sunday.
On All Saints' Day, France stops to remember its dead. A network of prepared exchange accounts, long-active wallets, and a patient fee payer stood ready for that pause, and a pseudonymous investigator reading a public ledger described the theft before the bank did.
The blockchain now records nearly every minute of what followed, down to the US$1,000 test payments and the overnight conversion of stablecoins beyond any issuer's reach. Arkéa has disclosed almost nothing about the moment the money left its control. It has not named the provider, described the authority the attackers exercised through its platform, or explained which controls permitted nine-figure transfers into accounts linked to the cash-out network. Every bank running payments through outsourced platforms needs that answer far more than it needs the wallet addresses.