Arkéa Cyberattack: Bank Security Meets Crypto Risk

The money came from a bank’s own account. The suspected trail led through cryptocurrency platforms. And the public exposure came from an independent blockchain investigator.

The Arkéa cyberattack brings together three questions often discussed separately: how financial institutions are breached, how stolen money becomes visible, and how much freedom banks will give customers to move digital assets.

It also gives fresh relevance to a warning from Binance founder Changpeng “CZ” Zhao. Speaking to CoinDesk on November 3, following Binance’s own major security breach, he argued that the danger extended across finance.

“If a crypto exchange can be hacked, banks are in a worse position, in my opinion,” he said.

A day later, Crédit Mutuel Arkéa publicly confirmed an attack involving fraudulent transactions. Blockchain investigator ZachXBT had already brought the suspected theft into public view and identified the bank as the alleged victim.

What happened in the Arkéa cyberattack?

Arkéa, the French cooperative banking and insurance group behind regional banking networks and subsidiaries including Fortuneo, says attackers reached it through a service provider’s platform.

According to its November 4 clarification, attackers used the bank’s own account to transfer money to other banks. Those transactions potentially enabled subsequent conversion into cryptocurrency through specialized platforms. Arkéa explicitly denied that Fortuneo was the entry point.

The bank declined to confirm the precise reported figure of €118 million, or $133 million, validating only its order of magnitude. Some funds had been blocked, further recovery efforts were underway, and the final financial impact remained undetermined.

Arkéa said customers’ holdings were unaffected. Certain transfers were delayed by precautionary restrictions, with operations resuming after security checks.

The account raises questions at every stage: how access through an external provider enabled payments, what the receiving institutions saw, and when information reached organizations able to stop the funds.

ZachXBT exposed the suspected theft before the bank spoke

ZachXBT’s role deserves a central place in that sequence.

On November 2, he flagged suspected losses exceeding $106 million from multiple centralized exchange accounts belonging to an unnamed European entity. He subsequently raised his estimate above $133 million and identified Arkéa before the bank’s public confirmation.

Unlock’s initial coverage of the suspected $106 million theft reflected the information available while the victim remained unidentified.

His work demonstrates how public blockchain scrutiny can expose suspected financial misconduct involving institutions outside the crypto industry.

The chronology does not establish whether Arkéa would have disclosed the attack without his intervention. It does establish that an independent investigator brought the suspected theft to public attention before the institution acknowledged it publicly. Arkéa separately says it informed authorities when it detected the attack.

Bitquery subsequently reported tracing $108.8 million in USDC withdrawals from wallets it labels as Kraken, Crypto.com and OKX to 15 addresses over approximately 21 hours on November 1–2.

Its analysis has an important boundary: it cannot see the preceding bank transfers or internal exchange accounts and cannot independently establish the complete connection to Arkéa. The traced withdrawals are therefore distinct from a confirmed final bank loss.

Bank records are private. Blockchain scrutiny is public.

Banks have transaction records and payment-tracking capabilities. Systems such as Swift’s tracker allow participating institutions to follow payments through its network, although the payment infrastructure used in this incident has not been established publicly.

The difference is who can examine the records.

An independent investigator cannot simply open a browser and follow transfers across banks’ internal ledgers. On a public blockchain, recorded movements between addresses can be examined from outside the institutions involved.

That visibility helped bring the suspected Arkéa theft into public view. It also explains why crypto incidents can attract immediate, detailed scrutiny while the banking portion of the same financial trail remains unavailable to outside observers.

Public visibility has limits. An address does not automatically identify its owner, and tracking funds does not guarantee recovery. Bitquery reported that much of the traced USDC was exchanged for ETH, moving that value beyond the stablecoin issuer’s token-freezing powers.

The practical challenge is turning visible movements into timely intervention.

UAE banks offer crypto trading within a closed loop

For banks adopting crypto, one response is already visible in the UAE: let customers buy, hold and sell digital assets, while restricting transfers into and out of the service.

This is what a closed loop crypto offering means for the customer. Money enters through the banking relationship, buys crypto within the product, and returns as money when the customer sells. Customers cannot use the service to receive coins from an external wallet or send their holdings to another blockchain address.

Liv’s published FAQ explicitly says that crypto transfers to or from Liv are unsupported. Its investment service operates through Aquanow, with Zodia Custody providing custody through that arrangement.

ADCB Securities’ FAQ similarly states that depositing or withdrawing cryptocurrencies is currently unsupported: customers can buy and sell on the platform. Its service connects customers with Fuze.

Standard Chartered’s UAE crypto investment service also prohibits crypto transfers in either direction. In its launch announcement, the bank explicitly described its custody and settlement structure as a closed loop model intended to reduce exposure to third-party wallet risks.

These offerings bring crypto investment into familiar banking channels while retaining a firm boundary around customers’ ability to move the assets.

Greater control comes with a trade-off

Restricting external crypto transfers removes a customer instruction that could otherwise send assets to a fraudulent address or bring externally sourced tokens into the product.

It also limits what customers can do with their holdings. They can participate in price movements, but cannot move those assets into self-custody, transfer them to another provider or use them directly elsewhere on the network.

The security question therefore becomes a product question: how much functionality will banks offer, and how much control will they retain?

The Arkéa cyberattack could strengthen the argument for controlled crypto services. But the incident also illustrates their limits. The initial fraudulent movements were bank transfers. A restriction on withdrawals from a bank’s own crypto product would not, by itself, stop money reaching another bank and then an external crypto platform.

Nor does restricting customer transfers eliminate the need to protect the institution’s custody systems, service providers and payment permissions.

CZ’s comparison between banks and exchanges remains his assessment; this incident alone cannot establish which sector is safer. What Arkéa makes clear is that the security debate already crosses both.

Banks can decide how tightly to contain crypto inside their apps. Protecting the money moving between institutions requires controls—and cooperation—that extend beyond those boundaries.