At Crédit Mutuel Arkéa, the customers are also the owners. Because on top of being “the bank to talk to”, as its French slogan goes, Crédit Mutuel is the bank that belongs to its customers, and that changes everything. Including this story. Because the group belongs to the local branches of Crédit Mutuel de Bretagne and Sud-Ouest, and those branches belong to their members, customers who have bought shares in them. All in all: 5.64M customers, 11,660 employees and some forty subsidiaries, including the online bank Fortuneo¹.

It is this branch of the family, long seen as the awkward cousin, at war with the others, that hackers have just helped themselves to, dipping into the bank's own money. No customer is affected, according to the group², which has apparently forgotten its own advertising slogan. The method is still unclear, and several sources inside the bank do not agree. As for the official representatives entitled to speak for Crédit Mutuel, they do not seem to know much more.

What remains is what the group eventually admitted. The hackers got in through the computer of a service provider that has rights over the bank's transactions³. From there, they send transfers to “other banking players”, in the group's words², on dates nobody wants to confirm. So Zero Bullshit went and read the blockchain.

It all starts on Sunday 1 November, All Saints' Day, a public holiday in France, when every branch is closed. A holiday weekend. When nobody is watching. The diverted money lands on accounts opened at 3 big CEX, Kraken, Crypto.com and OKX, crypto exchanges that act as online currency exchange offices. All of them fully regulated, by the way. On these accounts, the euros are changed into USDC, a stablecoin issued by the American company Circle, listed in New York, which keeps a large part of its reserves in a fund managed by BlackRock⁴. Then the USDC leaves the exchanges, withdrawn to 18 wallets controlled by the fraudsters. The recipient wallets.

1. Transfers from Arkéa

Euro transfers leave the group's own account for other banks. According to Arkéa, the attackers got in through a service provider's platform, not through Fortuneo.

2. Accounts on the exchanges

The euros land in Kraken, Crypto.com and OKX accounts that passed identity checks. Kraken says no customer account was hacked on its side.

3. Euros changed into USDC

On these accounts, the euros buy USDC, Circle's digital dollar. Nothing in USDT: since 2024 and 2025, these 3 exchanges no longer sell it to their European customers.

4. Withdrawals to 18 wallets

361 withdrawals leave the exchanges' shared exit wallets. This is the first visible trace. “Kraken” here means the exit door, not the origin of the money.

5. Laundering

508 wallets, $63M changed into ether overnight, then bridges to Tron and to Hyperliquid, where $14.25M was changed into a Monero token, instant exchanges and other exchanges.

Graph 1 · Euros turned into crypto

💡 A short glossary to follow the money
Stablecoin: a token always worth $1, because its issuer holds the equivalent in dollars. USDC is issued by Circle, USDT by Tether. They are the digital dollars of this story.
Blockchain: a public ledger where every transfer is recorded, readable by anyone. Here, mostly Ethereum and Tron.
Wallet: the equivalent of an account on a blockchain, with no name attached. Creating one takes a few seconds. Whoever holds its secret key controls the money.
Address: the number of a wallet. On Ethereum, a string of 42 characters starting with 0x.
Freeze: to block funds. An exchange can freeze a customer's account. Once the money has left for a wallet, only the issuer of a stablecoin can still freeze its tokens.
Ether and DAI: Ethereum's cryptocurrency, and a stablecoin with no central issuer. Nobody can freeze them.

What follows, Zero Bullshit reconstructed from 1 to 5 November, withdrawal by withdrawal, transfer by transfer. For the fraudsters, the race begins with the first withdrawal. The accounts have to be emptied before an alert shuts them down, then the USDC has to be changed into something nobody can freeze. Ahead of them, a public-holiday night.

The first test leaves OKX at 1.25pm: 48.9K USDC, to a wallet created that same day. At 4.33pm, on a Kraken account, withdrawals come one after another. 49K USDC, then 75K, 80K, 85K, 90K, 95K. A hand feeling for the ceiling. The amounts then settle just below the 100K mark: 99K, 99.9K, 99.5K. One withdrawal every 1 to 3 minutes. Around 5.20pm, 2 other accounts join in, and 3 accounts are then withdrawing at the same time. One in round amounts. Another to the exact dollar: 48,720, 49,367, 46,444. 2 different hands, or a program set up to imitate one. By 7pm, $12M has left.

Around 6.30pm, the withdrawals move up to millions, on 4 new recipient wallets. At 9.06pm, another account withdraws 1K USDC, as a test. 2 minutes later, $9.8M. At 9.52pm, a 2nd account does exactly the same thing. Then at 10.20pm, 10.35pm and 10.51pm, close to $9.6M each time, twice after the same 1K test. Between 9pm and midnight, $73M leaves Kraken, more than half the loot in 3 hours. None of these withdrawals is blocked.

Graph 2 · Hour by hour

The last withdrawal of that size comes at 11.04pm, on an address that is anything but new. Kraken paid it 7.15K USDC on 4 May, then small sums 48 times until the end of October, from $1.3K to $72K. That night, $9.58M, 1,340 times the first payment. 108 seconds later, the money is gone again.

By midnight, $105M has left the exchanges. Another $24M will follow on Monday, and $90K on Tuesday: 361 withdrawals, $129.6M in all, almost all of it at Kraken. Around midnight, the fraudsters' wallets hold about $95M in digital dollars, still freezable. On Monday at 9am, when offices open, $8M is left.

Graph 3 · The 18 recipient wallets