Crédit Mutuel Arkéa cyberattack and stolen funds, Digi Mart USA News (France): Daniel Baal, president of the Confédération nationale du Crédit Mutuel, said on France 5 that the Crédit Mutuel Arkéa had already recovered a portion of the stolen funds. The remark, reported by AFP on Monday, November 9, 2026, was the first positive news since the breach was disclosed the previous week.
He did not say how much had been recovered.
The estimated loot is about €118 million. That figure is AFP’s conversion of more than $133 million identified by ZachXBT, an independent cryptocurrency investigator.
The bank itself has only confirmed that more than €100 million left its accounts.
According to the source, the intruders entered through a bank provider’s platform and used the bank’s own account to send transfers to other institutions. Baal repeated that no private customer account was touched, as the bank stated in its communiqué of Wednesday, November 4.
Investigators tracking public cryptocurrency transactions were able to follow part of the money. Some funds were frozen while they remained in a blockable form, while most of the rest moved into Monero, a cryptocurrency designed to leave no usable trail.
The funds were first sent to accounts at exchange platforms, including Kraken, Crypto.com and OKX, where euros were converted into dollar-backed stablecoins such as USDC and USDT. Tether reportedly froze about $1.14 million, and Circle held about $3.7 million, according to ZachXBT’s count.
Kraken and Crypto.com said they had blocked accounts or funds linked to the theft.
Once converted to Monero, the funds could no longer be frozen by a central issuer. Recovering Monero in practice requires seizing the wallet itself and identifying the person who controls it.
ZachXBT criticized the bank for reporting too slowly and estimated that more than $30 million could have been frozen before conversion. The bank has not publicly responded to that criticism.
European rules are tightening. Since July 1, 2026, platforms serving clients in Europe must hold authorization under the MiCA regulation, and a second deadline arrives in 2027.
Article 79 of EU anti-money-laundering regulation 2024/1624 will bar banks, financial institutions and crypto platforms from maintaining accounts that enable anonymity or enhanced opacity of transactions, including through enhanced-anonymity tokens such as Monero, starting July 10, 2027.
For Crédit Mutuel Arkéa clients, the bank says nothing changes on their accounts, and the loss, whatever portion is ultimately recovered, does not affect customer accounts. The group reported €450 million in profit for 2025.
Baal also said the bank would have been fully able to cover any losses that had hit individual accounts.
