Crédit Mutuel Arkéa Hack: $133M Stolen Through Crypto Exchanges — 5 Numbers That Decide If Your Money Is Safe

A French bank with more than $250 billion in assets just admitted attackers drained its own account — and blockchain investigator ZachXBT traced more than $133 million of the money through Kraken, Crypto.com and OKX in roughly 21 hours. Part of it has already been frozen. Part of it is gone, swapped into ether and Monero through instant exchanges that ask almost no questions.

The victim is Crédit Mutuel Arkéa, the Brittany-based banking group behind Crédit Mutuel de Bretagne and the online bank Fortuneo. On November 4, 2026, the bank confirmed it was the target of a cyberattack that enabled fraudulent transactions. It would not confirm the $133 million figure — only that the order of magnitude was about right.

This is not another story about a crypto exchange getting hacked. No exchange was breached. The theft started in traditional banking, and crypto was the getaway car. That distinction matters, because it decides what you should actually do to protect your own money — and most of the early coverage got it wrong.

What Actually Happened: The Timeline

The money moved fast, and the public only caught up days later. Here is the sequence as reported by CoinDesk, Unchained and Bitcoin.com, pieced together from ZachXBT's public posts and the on-chain analysis firm Bitquery.

November 1–2: the drain. Around $108.8 million in USDC was withdrawn from accounts at Kraken, Crypto.com and OKX, directed to 15 wallets in roughly 21 hours, according to Bitquery. The first withdrawal left OKX on November 1 at 14:25 Asia/Gaza time. In total, Bitquery mapped 178 transactions across the three exchanges.

November 2: the flag. ZachXBT, the pseudonymous on-chain investigator, posted that an unnamed European entity had lost more than $106 million from accounts on centralized exchanges. At that point, nobody knew whose money it was.

November 3: the total grows. ZachXBT traced another $27 million in withdrawals and raised his estimate past $133 million. He accused the victim of covering the theft up, arguing that the silence had let the attacker launder more than $30 million in the meantime.

November 4: the name. ZachXBT named Crédit Mutuel Arkéa as the suspected victim. Hours later, the bank confirmed in a statement that it had been hit by an attack that enabled fraudulent transactions, and said the incident was under control. In a second statement the same day, published in French as answers to press questions, the bank said the attackers may have converted the money into crypto through specialized platforms. It rejected press reports that the attackers came in through Fortuneo, its online banking subsidiary.

November 5: the scale, confirmed in outline. Asked whether €118 million (about $133 million) had been taken, Arkéa said it does not confirm those figures and can only validate the order of magnitude. Part of the funds has been blocked, recovery steps are underway, and the bank says the sums at stake do not threaten its financial health. Customer funds were never touched — the attackers used the bank's own account.

The $133 Million Math: What We Know and What We Don't

The headline number is a sum of two separate on-chain findings, and the two investigators who produced them do not agree on everything. Before you repeat the $133 million figure, here is exactly where it comes from — and what is still unproven.

Two warnings matter here. First, Bitquery's $108.8 million and ZachXBT's $133 million are different tracing scopes — they should not simply be added together. Second, Bitquery itself says the blockchain data alone cannot prove the bank was the victim, and that the flow looks more like a trading or payments business than a custodied fund. The $133 million total, the victim's identity and the cover-up claim all come from ZachXBT. The bank has confirmed an attack and validated the order of magnitude — nothing more precise.

That does not make the story small. Even at the low end of the range, this is one of the largest bank thefts of 2026, and it happened in under a day.

How the Money Moved: USDC to ETH to Monero in 21 Hours

The laundering path is the most instructive part of the whole incident, because it shows exactly how stolen money crosses from the regulated world into the unregulated one — and where the trail goes cold.

According to ZachXBT's tracing, the attacker aggressively swapped USDC for ETH, moved funds through instant exchanges such as WellWallet and Kyrrex, converted some of it to Monero (XMR) via the swap service Wagyu, and bridged across multiple chains. Bitquery's snapshot found that about $63 million in stablecoins was exchanged for 27,553 ether during the night of November 1–2, including transactions routed through UniswapX. By November 3, roughly $61 million was still sitting on Ethereum in wallets tied to the thief, while about $50.29 million had already exited the chain.

That pattern — stablecoin to ether to Monero — is the classic laundering funnel of 2026. USDC is traceable and freezable; its issuer can blacklist addresses. Ether is harder to freeze but still fully transparent on-chain. Monero is the end of the line: its privacy design hides sender, receiver and amount, which is why it is the destination of choice for thieves who have already been spotted. Once money becomes Monero, investigators are effectively blind.

The speed is the point. Fifteen wallets, 178 transactions, three major exchanges, 21 hours. The attacker did not need to break any blockchain. They needed exchange accounts that would let them withdraw nine figures quickly — and those accounts existed, because the victim, whoever it ultimately proves to be, was a large institutional-style customer, not a retail user with a $10,000 daily limit.

What Most People Get Wrong About This Hack

Within hours of the story breaking, social media had already rewritten it into something it is not. Here are the three myths doing the most damage — and the facts that replace them.

Myth 1: "A crypto exchange was hacked." No exchange was breached. Kraken, Crypto.com and OKX have all said their platforms were not hacked, and nothing in the on-chain evidence suggests otherwise. The withdrawals came from accounts the attacker controlled — the compromise happened upstream, in the traditional banking world. The exchanges were the exit, not the entry point.

Myth 2: "Crypto is unsafe, so the bank's money was stolen because it was in crypto." The money was not stolen because it was in crypto. It was stolen through fraudulent banking transactions, and then moved into crypto because crypto moves fast and crosses borders without a compliance department asking questions at 2 a.m. The theft is a banking-security failure; crypto is the laundering rail. Blaming the rail misses the break-in.

Myth 3: "The bank covered it up." ZachXBT accused the victim of a cover-up, and the two-day silence before the bank's statement feeds that reading. But banks do not announce nine-figure thefts the moment they discover them — they notify regulators and law enforcement first, freeze what they can, and only then speak publicly. Arkéa says it notified the relevant authorities and temporarily suspended some transactions. Silence in the first 48 hours is standard incident response, not proof of a cover-up. What matters is whether the recovery is real, and that is still unproven.

There is a fourth, quieter misunderstanding worth naming: that this could not happen to a bank with $250 billion in assets. Size does not buy immunity. The $6.3 billion Binance hack in late October 2026 — the largest exchange theft in history — showed that the biggest targets attract the most patient attackers. Arkéa is simply the latest proof that the target list now includes traditional banks, not just crypto companies.

5 Numbers That Decide If Your Money Is Safe

The Arkéa case is about a bank's own account, not yours. But the same laundering playbook targets ordinary holders every week, and the defenses are the same ones that would have slowed this attack down. Check yourself against these five numbers.

1. $0 — the amount of crypto you should hold on an exchange you do not need to trade on. The Arkéa thief needed exchange accounts to cash out. Your exchange account is the same kind of exit point for anyone who gets your login. If you are not actively trading, your coins belong in self-custody, not on an exchange. Our guide to the best crypto wallets in 2026 compares seven options after the $6.3 billion Binance hack, including prices and the one beginner mistake that costs people their funds.

2. 21 hours — how fast $108.8 million can leave three exchanges. That is the window in which the Arkéa funds moved. If an attacker gets into your account, you do not have days to notice — you have hours. Turn on withdrawal allowlisting (also called address whitelisting) on every exchange you use, so funds can only go to addresses you pre-approved. Set up transaction alerts by email and SMS. The goal is not to make theft impossible; it is to make it slow enough for you to catch it.

3. 15 wallets — the number of destinations Bitquery traced. Fifteen wallets is not a coincidence; it is a deliberate split to dodge per-wallet monitoring. The same trick is used against individuals: a phishing victim's funds are split across dozens of wallets within minutes. If you ever need to report a theft, speed matters more than anything — exchanges and investigators can freeze funds only while they are still on a centralized platform. Once they hit Monero, they are gone.

4. 27,553 ETH — the amount swapped in a single night. The attacker converted about $63 million of stablecoins into ether in hours, partly through UniswapX. That volume moved without tripping a single circuit breaker, because the trades were split across venues. For you, the lesson is different: if your stablecoins are the thing that gets stolen, they are the easiest to freeze — USDC's issuer can blacklist addresses — but only if you report the theft immediately with the transaction hashes in hand. Keep records of your wallet addresses and transaction IDs somewhere an attacker cannot reach.

5. $250 billion — the assets of the bank that got hit. If a bank that size can lose nine figures through its own account, no institution's security is a substitute for your own. Hardware wallets remain the strongest single defense for long-term holdings: keys that never touch the internet cannot be drained by a remote attacker. Our comparison of Ledger vs Trezor hardware wallets covers the trade-offs, and our guide to storing crypto safely walks through cold storage and seed-phrase security step by step.

What the Exchanges Did — and What They Didn't

Crypto.com said it blocked funds linked to the incident and that customer funds remained secure. OKX confirmed it blocked accounts linked to the attack. Kraken has not been reported as making a public statement at the time of writing, and investigators have not determined how the attacker accessed the exchange accounts in the first place.

That last gap is the most important unanswered question in the story. If the attacker had the exchange account credentials, this was a credential-theft case that happened to target a very large victim. If the accounts were opened fraudulently, it is an onboarding failure at three separate exchanges. Either way, the exchanges' ability to block funds after the fact is the only reason part of the $133 million has not already vanished into Monero — and the fact that roughly $50 million had already exited Ethereum by November 3 shows how narrow that window is.

There is a wider lesson here for the industry. After the $6.3 billion Binance hack, exchanges tightened withdrawal monitoring and several, including Binance itself, saw net inflows return as users decided the platform was still the safest place to park funds. The Arkéa case tests that logic from the other side: the exchanges were not the victim, but they were the laundering route, and their compliance teams are now the ones answering questions from French regulators.

What This Means for Your Money

If you bank with a traditional institution, the Arkéa statement is actually reassuring on one point: the bank says customer accounts were not touched, and that clients' interests are fully protected. A bank's own-account fraud does not reach your deposits, and European deposit protection schemes cover eligible deposits up to €100,000 regardless.

If you hold crypto, the implications are more direct. Expect three things in the coming weeks. First, exchanges will tighten large-withdrawal reviews — if you move five or six figures, expect delays and questions you did not face a month ago. Second, regulators in France and across the EU will ask harder questions about how institutional accounts are verified, which could mean new paperwork for business accounts. Third, Monero's role as the laundering endpoint will put privacy coins back in the regulatory spotlight.

None of that changes what you should do today. Move long-term holdings off exchanges into self-custody. Enable withdrawal allowlisting everywhere it is offered. Use a hardware wallet for anything you do not plan to trade this month. And if you are buying crypto for the first time, start with our guide to buying Bitcoin safely in 2026, which was rewritten after the Binance hack with seven steps that keep your BTC yours.

Frequently Asked Questions

Was Crédit Mutuel Arkéa hacked?

Yes — the bank confirmed on November 4, 2026 that it was the target of a cyberattack that enabled fraudulent transactions, and said the incident was under control. It has not confirmed that it is the victim of the $133 million theft ZachXBT traced, and it has not confirmed the $133 million figure itself, only that the order of magnitude is about right.

How much money was stolen in the Crédit Mutuel Arkéa hack?

The suspected total is more than $133 million, according to on-chain investigator ZachXBT — $106 million first flagged on November 2, plus about $27 million found on November 3. Bitquery independently traced about $108.8 million in USDC withdrawn from Kraken, Crypto.com and OKX. The bank has not confirmed any specific figure, so $133 million remains an outside estimate, not a confirmed loss.

Were customer funds affected?

No, according to the bank. Arkéa says the attackers used the bank's own account, not customer accounts, and that clients' interests are fully protected. A spokesperson told CoinDesk the incident has no financial consequences for clients.

Were Kraken, Crypto.com or OKX hacked?

No. All three exchanges say their platforms were not breached. The withdrawals came from accounts the attacker controlled, and the compromise happened outside the exchanges. Crypto.com and OKX have both said they blocked funds and accounts linked to the incident.

Where did the stolen money go?

About $63 million in stablecoins was swapped for 27,553 ether in a single night, partly through UniswapX, according to Bitquery. ZachXBT traced further movement through instant exchanges and conversion to Monero via the swap service Wagyu. By November 3, about $61 million was still on Ethereum in wallets tied to the thief, and about $50.29 million had already exited.

Can the stolen crypto be recovered?

Part of it, possibly. The bank says part of the funds has been blocked and recovery steps are underway. Funds still sitting on centralized exchanges or in freezable stablecoins like USDC can be seized. Funds already converted to Monero are effectively unrecoverable, which is why the first hours after a theft matter so much.

The Bottom Line

A major French bank lost something on the order of $133 million in under a day, and the money crossed from traditional banking into crypto in 21 hours — through accounts at three of the world's largest exchanges, into ether, and on toward Monero. The bank confirmed the attack but not the amount. The exchanges blocked what they could but could not say how the attacker got in. And roughly $50 million had already left Ethereum before the public even knew a theft had happened.

The uncomfortable truth is that the system worked exactly as designed — for the attacker. Banking transfers are fast, exchange withdrawals are fast, and privacy coins are the off-ramp.

For you, the takeaway is not to fear crypto or to fear banks. It is to stop outsourcing your security to either of them. Self-custody, withdrawal allowlisting, a hardware wallet and a habit of checking your accounts daily are the four defenses that would have mattered here — and they are the four defenses that matter for every holder, whether you own $100 of Bitcoin or $100 million of it.

Sources: CoinDesk, "ZachXBT names French bank Crédit Mutuel Arkéa in $133M crypto exchange theft" (Nov 4, 2026); Unchained, "Crédit Mutuel Arkéa Says Attackers Drained Its Own Account and May Have Cashed Out in Crypto" (Nov 5, 2026); Bitcoin.com, "Credit Mutuel Arkea Cyberattack: $133M Traced to Crypto Exchanges" (Nov 4, 2026). Figures attributed to ZachXBT and Bitquery are estimates unless stated otherwise by the bank. This article is for information only and is not investment advice.