A Weak Link at a Vendor Let Hackers Reach a French Bank’s Money, and Crypto Trackers Saw It First

The breach at Crédit Mutuel Arkéa is a reminder that a bank can be exposed through a company it hires, not only through its own defenses. The group says attackers got in via an outside service provider, and the online bank Fortuneo was not the entry point. From there they moved the bank’s own money to other institutions, where it could be turned into crypto.

Blockchain Data Exposed the Theft Before the Victim Was Named

The first clues came from public ledgers. Bitquery spotted suspicious withdrawals from accounts at Kraken, Crypto.com and OKX while nobody yet knew whose money it was. ZachXBT then flagged more than $106 million on Monday and pushed his figure past $133 million on Tuesday after finding roughly $27 million more. By Wednesday his report had named Arkéa as the probable victim.

What Exchanges Did

Kraken and Crypto.com said they limited accounts or held back funds linked to the case, and both say their own systems were not compromised.

What the Bank Says Now

Arkéa confirmed the incident but declined to verify exact numbers, saying only that the scale is comparable to the estimates. Customer funds were not affected, and the only damage was slower processing of some transfers. After extra checks and new safeguards, nearly everything was back online Wednesday. Some stolen money is frozen, recovery efforts continue, and the bank is still working out the financial hit.