The hacker used a forged identity to bypass the bank wire transfer and exchange KYC, completing a precisely calculated on-chain transfer.

Written by: ChandlerZ, Foresight News

On November 4th, Crédit Mutuel Arkéa in France confirmed that it had suffered a cyber attack that resulted in the execution of some fraudulent transactions. According to French media Le Télégramme, the amount involved exceeds $133 million (€118 million), and Crédit Mutuel Arkéa has notified the Banque de France about this matter.

Crédit Mutuel Arkéa stated in a declaration that it had suspended some transactions as a precautionary measure after discovering the attack, to prevent further fraudulent funds flow. Transactions will be resumed as soon as final verification and security measures are completed. Reports indicate that some transfer features within its banking application are still unavailable.

Grégory Raymond, co-founder of the French crypto media The Big Whale, quoted on-chain investigator ZachXBT as saying that the specific victim was the online bank Fortuneo, which belongs to the group. According to his investigation, the hacker group transferred fiat currency from the bank to cryptocurrency exchanges, exchanged it for stablecoins, and then withdrew it to external wallets; the actual losses on the bank's side may be higher than the amounts currently tracked on-chain.

The French banking group behind the implicated online bank Fortuneo

Fortuneo, at the center of this incident, was founded in 2000 and is a mainstream personal online bank in France. Unlike e-wallets that only provide small payments, Fortuneo's operations are highly comprehensive, covering personal accounts, large savings, real estate loans, and active online securities investments, gathering a large number of retail customers accustomed to managing large sums of money online.

In 2006, Fortuneo was acquired by the Crédit Mutuel Arkéa banking group. Crédit Mutuel Arkéa is a large cooperative financial institution in France, overseeing offline retail banking, insurance, and asset management businesses. By the end of 2025, the group’s total assets were approximately €211.6 billion, with a net profit of €450 million for that year; by the first half of 2026, the group had reached 5.8 million customers.

The online banking business has been a key expansion point for the Crédit Mutuel Arkéa group in recent years. In addition to operating Fortuneo in France, the group also operates the online bank Keytrade Bank in Belgium. By the end of 2025, these two online banks had a combined customer base of 1.63 million, accounting for nearly 30% of the group’s total customers; in the first half of this year, its online banking segment added another 180,000 customers.

Opening accounts with forged identities, then receiving bank transfers

According to reporter Grégory Raymond citing insiders, the hacker group had prepared multiple accounts on cryptocurrency exchanges in advance. They opened accounts on platforms like Kraken using forged identification, and the submitted materials passed the exchanges' identity verification.

Once the accounts were ready, the hacker group managed to initiate bank transfers from Fortuneo to these accounts. Platforms like Kraken usually require that the name on the remittance account matches the real name of the exchange account holder. Raymond stated that the names used for the transfers matched the names of the exchange account holders, and the funds were verified before the hacker group used them to purchase stablecoins.

Crédit Mutuel Arkéa has confirmed that it suffered a cyber attack, but how the hacker group initiated transfers from Fortuneo has not been disclosed. An insider indicated that the bank's payment system may have been compromised, or that employees may have been deceived. This insider leans toward the latter theory, suspecting that the scammers impersonated executives to induce employees to transfer funds; the bank has not confirmed this statement.

Meanwhile, Kraken told Cointelegraph that its security systems were not breached, and no customer accounts were taken over by third parties. After the purchase of stablecoins, the hacker group withdrew them to external wallets, and the funds began to flow on-chain.

21-hour withdrawal peak and a six-month dormant receiving wallet

The blockchain data analysis firm Bitquery conducted a complete trace of the related fund flows on Ethereum, tracking the funds from three exchanges to 229 on-chain wallets.

Data shows that within approximately 21 hours from November 1 to 2, a total of $108.8 million in USDC flowed from the main wallets of Kraken, Crypto.com, and OKX to 15 primary receiving wallets. At 8:25 PM Beijing time on November 1, the first withdrawal was initiated from OKX; 44 minutes later, related withdrawals began on Kraken, which ultimately accounted for about 95% of the total amount of these withdrawals (a total of 178 withdrawals).

The fund outflow was highly concentrated during Sunday night. From 4 AM to 7 AM Beijing time on November 2, a total of $73.2 million flowed out within three hours, accounting for two-thirds of the total withdrawals; by 7:10 AM Beijing time on November 2, 98% of the funds had been withdrawn. To bypass the single withdrawal limit imposed by trading platforms, one new wallet received 43 withdrawals from Kraken in 91 minutes, with each amount precisely controlled to be below $50,000.

Among the 15 primary wallets that received withdrawals from the exchanges, 11 were not new addresses but had received payments from the aforementioned exchanges before this incident, collectively accounting for 84% of the outflow funds. The earliest address (0x730b…3992) had its first withdrawal from Kraken on May 4 this year and had 48 withdrawal records before the incident, with multiple addresses having had inter-transfers and outgoing payments this summer.

Additionally, 8 out of these 15 primary wallets and 20 addresses involved in subsequent fund transfers all used the same client configuration, all being Trust Wallet smart accounts, uniformly configured to use USDC for direct gas fee payments. This high consistency in historical interactions and technical configurations indicates that the operations involving the withdrawals from exchanges and the control of on-chain wallets were by the same team. Once the funds entered the primary wallets, they rarely stayed, with a median waiting time of only 3 minutes before transferring to new addresses.

From 7:44 AM to 12:02 PM on November 2, one of the related wallets exchanged approximately $62.98 million in USDC and USDT for 27,553 ETH via UniswapX. UniswapX is an on-chain trading mechanism where competing liquidity providers search for liquidity and complete exchanges, allowing significant funds to be exchanged in batches for target assets.

After account restrictions, which funds can still be recovered?

As of now, Kraken has announced it has started freezing related funds, confirmed restrictions on the implicated accounts, and is cooperating with law enforcement; Crypto.com also stated that it has taken measures to prevent the related funds from flowing through its platform, while OKX is checking the situation.

According to a chain snapshot captured by Bitquery on November 2, about 72% (equivalent to $78.27 million) of the $108.8 million tracked funds remain in 229 wallets associated with the perpetrators on the Ethereum network, while about $30.49 million has flowed out through various channels. Among the assets still remaining on the Ethereum network, there are 30,200 ETH, 5.64 million DAI, and 3.74 million USDC.

Among the $30.49 million in funds that have flowed out of Ethereum wallets, three main transfer channels have emerged:

The first is centralized exchange recharge channels. The largest single exit is a KuCoin recharge address (0xbb2a…295a), which received a total of $8.12 million and was aggregated to the KuCoin main wallet. The on-chain intelligence agency TRM Labs marked this fund flow as associated with the European crypto platform Kyrrex, speculating that this address may be a fund aggregation account that Kyrrex opened on KuCoin.

The second is cross-chain bridge and privacy coin exchange channels. About $7.1 million net flowed into 6 cross-chain bridges and routing protocols, with the cross-chain aggregator LI.FI receiving $4.34 million, which included 2.6424 million USDC and 355.53 ETH flowing into Wagyu service through 20 disposable order wallets, designed specifically for exchanging crypto assets into Monero. Due to Monero's ability to hide the participants and amounts in transactions, this portion of funds has left the tracking visibility of public ledgers.

The third is instant exchange and OTC channels that do not require account registration. Instant exchange service FixedFloat received $1.32 million, while WellWallet received $250,000; additionally, $12.91 million flowed into multiple unmarked addresses, which matched the high-frequency exchange and distribution characteristics typical of OTC dealers.

Overall, the delay in emergency response significantly increased the difficulty of recovery. ZachXBT pointed out that after he issued a warning for the first time on November 2, over $27 million in funds were withdrawn through related channels; if the bank had disclosed the incident to law enforcement and the industry earlier, a significant portion of the funds could have been intercepted in time.

Currently, Crédit Mutuel Arkéa has reported the incident to the Banque de France. The group stated that suspending some transactions temporarily was to prevent new fraudulent funds flow and that it would resume operations as soon as final verification and security enhancements were completed. As for how the attackers bypassed the bank's risk control to gain transfer permissions, the final verified loss scale, and recoverable amounts, further disclosures from the bank and French regulatory authorities are still awaited.