Crédit Mutuel Arkéa fraud: what is established, what is claimed, what victims can do

Sunday 1 November, 12:25 (UTC): a first withdrawal leaves an account opened with OKX. Within twenty-one hours, more than one hundred million dollars in stablecoins leave three exchanges. According to early reconstructions, these accounts had passed identity checks, and the bank transfers that funded them carried the exact name of the account holder. On Wednesday, Crédit Mutuel Arkéa confirmed an attack. The fraud appears to have circumvented no control at all: it seems to have passed them all.

Key points

• On 4 November 2026, Crédit Mutuel Arkéa confirmed a cyberattack that enabled “fraudulent transactions”. The bank states that its customers suffer no financial consequences and gives no figure.
• According to on-chain investigator ZachXBT, more than $133 million (about €118 million) was withdrawn in stablecoins and then laundered, partly through Monero. The bank has not confirmed this figure.
• Verification of Payee checks that a name matches an IBAN, not that the person exists. An account opened under a false identity passes it.
• Depending on how the fraud was carried out, the facts would amount to fraud (escroquerie) or computer hacking, followed by money laundering: up to ten years’ imprisonment when committed by an organised gang.
• A customer who finds an unauthorised transaction must report it without delay, and no later than thirteen months after the debit. The bank must then refund it by the end of the following business day at the latest.

What happened at Crédit Mutuel Arkéa?

According to the analytics firm Bitquery, about $108.8 million in USDC, a stablecoin pegged to the dollar, was withdrawn within twenty-one hours from accounts opened with Kraken, Crypto.com and OKX¹. On-chain investigator ZachXBT raised his estimate to more than $133 million, then named Crédit Mutuel Arkéa during the night of 3 to 4 November².

On 4 November, the bank confirmed an attack that enabled “fraudulent transactions”, an incident it describes as “now under control”, with “no financial consequences” for its customers³. It has commented on neither the amount nor the method.

The same day, journalist Grégory Raymond published a reconstruction based on unnamed sources: Fortuneo, the group’s online bank, was allegedly the target, and its transfers allegedly funded exchange accounts opened under falsified identities⁴.

Timeline of the fraud

What is established, and what is merely claimed?

First, the material evidence is on the blockchain. The withdrawals, conversions and addresses are public and can be checked by anyone; they are reported here as analysed by Bitquery and ZachXBT. But the blockchain does not say who owned these funds. The link with Crédit Mutuel Arkéa rests on ZachXBT’s assertion, and he has not published his evidence.

Second, the bank’s confirmation of the attack is a statement against its own interest, and as such it carries weight. The rest of its statement is of a different nature: that the incident is under control and that customers are unaffected are the bank’s own assertions, which nothing yet allows anyone to check.

Third, the banking circuit rests on anonymous sources, and the account changed within a day: Grégory Raymond’s first post referred to “money mule” accounts, his second to falsified identities⁴. The point of entry remains unknown: one source suggests a compromise of the payment systems or, more likely in its view, an internal human failure. No authority has attributed the attack.

How did the fraud pass the controls?

If the reconstruction is confirmed, the controls worked exactly as designed, on false premises.

First, Verification of Payee does not verify that the payee exists. Since 9 October 2025, under Regulation (EU) 2024/886, banks must check, before executing a transfer, that the name entered matches the holder of the IBAN⁶. If the receiving account was opened under a false identity and the transfer bears that false name, the check reports a match. It is right.

Second, exchanges’ identity checks verify documents. Authorised crypto-asset service providers are subject to anti-money laundering obligations (Article L. 561-2, 7° bis, of the French Monetary and Financial Code). According to Grégory Raymond’s sources, the identities used were convincing enough to pass these checks⁴. The bank and the exchange would thus each have validated two lies that were consistent with each other.

The question Grégory Raymond raises remains open: how could transfers of this size leave the bank over several days without triggering an alert?

Hacking, fraud, money laundering: which offences?

The legal characterisation depends on the method, which is not known.

If a person was deceived, for instance an employee led to execute false payment orders, the facts would amount to fraud (escroquerie): deceiving a person, in particular by using a false name, so as to induce them to hand over funds. It carries five years’ imprisonment and a €375,000 fine (Article 313-1 of the French Criminal Code), and ten years and €1 million when committed by an organised gang (Article 313-2).

If the payment systems were compromised, the facts would fall under offences against automated data processing systems. Fraudulently entering data into a system, such as false payment orders, carries five years and €150,000 (Article 323-3), and ten years and €300,000 when committed by an organised gang (Article 323-4-1).

In both cases, what followed is money laundering: assisting in the conversion of the proceeds of an offence carries five years and €375,000 (Article 324-1), and ten years and €750,000 when committed by an organised gang (Article 324-2). Since 15 June 2025, Article 324-1-1 presumes that funds are illicit when the transaction can have no other justification than to conceal their origin, and expressly covers crypto-assets with a built-in anonymisation feature. Monero is the textbook example.

Why were the funds not frozen in time?

A freeze is only possible while the funds remain in an asset that can be frozen. An issuer can block USDC or USDT, and an exchange can block an account: Kraken and Crypto.com say they did so⁵. Once the funds have moved into ether and then Monero, no one controls them any more.

Yet an exchange does not freeze on the strength of a rumour. According to a source cited by Grégory Raymond, in the absence of official confirmation from the bank, exchanges and issuers could not block the funds in time⁴. ZachXBT estimates that more than $30 million could have been frozen². These are an anonymous statement and an estimate, but they describe a mechanism every practitioner knows.

It is a criminal complaint, filed without delay, that opens the way to coercive measures: from the investigation stage, the liberty and custody judge (juge des libertés et de la détention), on application by the public prosecutor, may order the seizure of crypto-assets (Article 706-153 of the French Code of Criminal Procedure). The prosecutor still has to be seized before the funds move. Here, $63 million was converted in four hours.

Fortuneo and Arkéa customers: your rights

The bank states that its customers suffer no financial consequences. Check your statements nonetheless: if a transaction you did not authorise appears, the law protects you.

First, report it without delay, and no later than thirteen months after the debit date, failing which the right is time-barred (Article L. 133-24 of the French Monetary and Financial Code). For a transaction debited on 2 November 2026, the deadline is 2 December 2027.

Second, the bank must refund you by the end of the business day following your report at the latest (Article L. 133-18). It may refuse only if it suspects fraud on your part and informs the Banque de France in writing. Any delay triggers interest at the statutory rate increased by five to fifteen points.

Keep your statements and dated screenshots of your online banking space.

Fake bank adviser: the scam that follows

The pattern has already been reported: a fake adviser calls, sometimes from a number displayed as the branch’s own, refers to the attack and asks the customer to approve a transaction “to block” a fraud, or to move savings to a “secure” account⁷. By approving, the victim authorises a payment to the fraudster.

A bank never asks you to approve a transaction by phone in order to cancel another. If in doubt, hang up and call the number on your card yourself. If you have already approved, block your card, report the transaction in writing and file a complaint within the hour: the bank will argue that the transaction was authorised, and that dispute is shaped by the very first written exchanges.

Was your identity or your account used?

If the identities used were stolen from real people, those people will be named as holders of accounts that received millions, and they will be questioned. If money mule accounts were used, their holders face money laundering charges, with the presumption of Article 324-1-1. In both cases, a summons is not a formality: the defence is prepared before the first interview.

How the firm can help

The firm handles financial fraud, cybercrime and crypto-asset cases, acting for victims as well as for the defence.

First, for companies hit by payment fraud or an intrusion: a criminal complaint within the first hours, fund tracing, freeze requests to exchanges and stablecoin issuers, seizure applications, joining the proceedings as a civil party.

Second, for individuals: disputing an unauthorised transaction, formal notice to the bank, assistance for victims of a fake bank adviser.

Third, for people whose identity was stolen or whose account was used: assistance from the summons onwards, whether in a voluntary interview or in police custody.

The first hours and the first documents matter. The firm can be contacted now.

Frequently asked questions

Was Crédit Mutuel Arkéa hacked?

On 4 November 2026, Crédit Mutuel Arkéa confirmed a cyberattack that enabled “fraudulent transactions”. The bank says the incident is under control and has disclosed neither the method nor the amount.

How much money was stolen?

According to on-chain investigator ZachXBT, more than $133 million, about €118 million. This figure reflects withdrawals visible on the blockchain and has not been confirmed by the bank.

Is Fortuneo affected?

According to journalist Grégory Raymond’s sources, Fortuneo, the group’s online bank, was the target. The bank’s statement does not name it: the information has not been officially confirmed.

I am a Fortuneo or Arkéa customer: what should I do?

Check your statements. An unauthorised transaction must be reported without delay, and no later than thirteen months after the debit. The bank must then refund it by the end of the following business day at the latest.

Can the funds be recovered?

Partly, perhaps: Kraken and Crypto.com say they restricted accounts or blocked funds. But the share converted into Monero, a cryptocurrency designed to make transactions untraceable, is practically lost.

I have been summoned about an account opened in my name. What should I do?

Do not attend alone. You will be questioned about facts that may be characterised as money laundering, for which the law provides a presumption as to the origin of the funds. The firm can step in from the summons onwards.