Arkéa: the race to bring stolen money home

Bringing the money back depends on who can still act on it. Payment rules and court records reveal the separate stages between tracing funds and making them usable again.

On 4 November, Crédit Mutuel Arkéa said almost all its operations had resumed after an attack. Some of the money involved had been blocked, the bank said, while recovery efforts continued. Operations could resume while the effort to recover the money remained unfinished. ¹

The gap between them contains much of the work that disappears from the public account of a digital theft. A bank looks for the next institution able to stop a payment. An investigator connects transactions to people. An authority decides who is entitled to an asset that has been secured. Each can move the case forward, using different powers and evidence.

Arkéa provides a starting point for examining that process. Public documents describe money leaving the bank and recovery efforts under way. The current distribution of the funds, their legal status and the amount already returned remain unresolved in the material reviewed. Payment rules and documented cases help explain the work required to turn a trace into a recovery.

The route is still being established

According to Arkéa, the attackers used an account belonging to the bank after gaining access through a service provider’s platform. Transfers went to other banking institutions. The bank says those transactions may subsequently have enabled conversion into cryptoassets. It rules out its Fortuneo subsidiary as the entry point and says the €118 million cited in a question in its public FAQ gives the right order of magnitude, while leaving the exact amount unconfirmed. ¹

Reuters reported an estimate of about €100 million on 5 November, along with the opening of an investigation by Paris prosecutors following the bank’s complaint. Arkéa’s spokesperson declined to identify the service provider. The bank says customers’ assets were unaffected, although some payments were delayed. Its final financial assessment remained pending. ²³

Le Monde reported on November 5 that Kraken received unusual transfers and blocked transactions in progress. Kraken appears in that account as a recipient, distinct from the unnamed provider used to gain access to Arkéa. The newspaper describes action at the receiving end; the bank’s official account still leaves the amount actually returned unresolved. ²²

The bank’s statements describe the broad stages of the theft, while leaving the payment network, recipient institutions and grounds for each block unspecified. Le Monde’s account supplies further detail attributed to the newspaper. The mechanisms discussed here explain available routes to recovery. Evidence would be needed to establish which were used in this case.

As a payment moves, control changes hands

Consider a fraudulent transfer in general. While an instruction is awaiting execution, a stop mechanism may still intercept it, depending on the system. Once the receiving account has been credited, the originating institution needs another actor to intervene. That actor must locate the transaction, establish the grounds for acting and still have funds within reach. ⁴¹⁵

A payment recall is the procedure payment service providers use to request the funds back. Under rules published by the European Payments Council (EPC) for the Single Euro Payments Area (SEPA), it follows the route of the original transfer, gives a specified reason and requires a response. Debiting the receiving account then depends on the available balance, applicable law and contractual arrangements. In some circumstances, the recipient’s consent is required. An emptied or closed account, or a legal restriction, can produce a negative response. ⁴

An interbank recall and a judicial freeze therefore exercise different powers. The recall seeks the return of a payment. A freeze preserves an asset under legal authority while its disposition is determined. Both may proceed alongside one another. The practical challenge is to reach an actor who can still act on the value. ⁴⁶

Method and scope

Before execution, an order that can still be intercepted may encounter a stop. After credit, a recall seeks cooperation and a conditional return; funds may already have moved to another institution. The arrows distinguish the money transfer, the recall request and the potential return. The outcome depends on available funds, law and actors with authority to act. Swift provides messaging and stop-and-recall functions; it does not hold its customers’ funds or accounts. This figure attributes no payment rail to Arkéa.

Financial messaging can accelerate this coordination. Swift’s Stop and Recall service is designed to halt payments still in flight and route requests to the institution handling them. The service transmits and helps process instructions; the participating institutions manage the accounts and funds. Swift’s description explains its product. It supplies no evidence that the service was involved in the Arkéa incident. ¹⁵²⁰

Each onward transfer moves the question elsewhere: who controls the next balance, in which jurisdiction, and under what authority? Recovery requires investigators to keep the financial trail connected to the ability to intervene. Accurate information reaching an institution with no control over the asset still leaves another institution to find.

A recall can follow the completed payment

Instant euro payments demonstrate the speed of execution. European rules provide for funds to be made available, and execution confirmed, within ten seconds of the payer’s payment service provider receiving the order. That ceiling governs the payment process. ¹⁹

A recall brings its own request and response deadlines. Under the standard and instant SEPA rulebooks applicable at the time of this research, a recall citing a fraudulently originated instruction can be sent up to thirteen months after execution. The beneficiary’s provider must respond, positively or negatively, within fifteen banking business days of receiving the recall. These are deadlines for procedural actions and responses. Whether the funds remain available is a separate issue. ⁴⁵

This explains some of the urgency. A payment system can execute a transfer much faster than the exchanges needed to recover it. A long recall window preserves a procedural route. An early alert creates more opportunities to intervene before another movement. Public information on Arkéa, however, provides no basis for translating elapsed hours into a recovery probability.

Time operates alongside other factors. Will an intermediary cooperate? Are the assets still under its control? Does the request contain the necessary references? Can the competent authorities act? A rapidly initiated procedure may encounter a balance that has already moved. A late discovery may still lead to recovery when the conditions for intervention are met.

A thirteen-day delay still left an opening

On 29 October 2026, Singapore’s police announced that they had recovered US$12.8 million following a payment-diversion scam. A petrochemical company had transferred the money to a Cambodian account on 13 October. The fraud was discovered on 26 October, when its business partner said the expected payment had never arrived. Thirteen days separated the transfer from the report. ¹²

The police attributed the result to cooperation with Cambodian authorities and OCBC. Their statement announced recovery of the full amount without specifying when the money was finally credited to the company. It documents an individual success chosen for public disclosure. It provides no comparable success rate. ¹²

The lesson cuts in both directions. A completed transfer can leave routes to recovery open; the thirteen days in this case offer no safe waiting period. The case shows that the route taken by the money and the powers available to the institutions also matter. Elapsed time is useful information, alongside the state and location of the assets.

On a blockchain, an address is a starting point

Conversion into cryptoassets changes the available evidence. On a public chain, investigators can observe transfers between addresses, with amounts and their sequence. A report published by the Financial Action Task Force (FATF) in March 2026 describes how this visibility coexists with identities held off-chain and with internal exchange transactions that never appear on the public ledger. ⁸

The investigation must connect two sets of records. Bank statements and an intermediary’s books help establish money entering an account. The chain may then reveal a withdrawal to a public address. Joining these events requires evidence about the accounts involved, their holders and the transactions recorded. Two similar amounts appearing in succession provide a lead; the surrounding evidence determines its strength.

This boundary matters when reading Bitquery’s analysis of flows it associates with the Arkéa case. The blockchain analytics vendor has revised its coverage and acknowledges unexplained differences between its figures and other amounts reported around the incident. Its figures describe the scope it reconstructed at a particular point in time. A complete public reconciliation with the bank’s debits remains unavailable. ¹⁶

A visible balance can describe several different situations. It may still be movable, already restrained, held for several clients or subject to another party’s claim. The next question is practical: who has both the technical means and the legal grounds to act on that asset?

Several forms of control can overlap

The first is custody by an intermediary. An exchange holding cryptoassets for clients can act on the accounts it administers. In England and Wales, a freezing order can cover a wallet managed by a UK-connected service provider while the assets remain in that provider’s custody. This is a particular legal regime, useful for illustrating how control works. ¹⁷

The second is control built into a token. Some stablecoins, tokens designed to track the value of a currency, include mechanisms allowing their issuer to restrict transfers. Circle explains that it can block specified addresses from sending or receiving USDC or EURC, its dollar- and euro-referenced stablecoins respectively, including to comply with valid legal orders. That power applies to those tokens, under the issuer’s policy and applicable law. ⁹

The third is access to the means of signing. A private key produces the signature required to spend the corresponding assets. The public address identifies a destination; the private key provides the means to sign. Bitcoin relies on signatures and shared network rules, without a central issuer administering balances. ¹⁰

These controls overlap. An exchange may hold both bitcoin and stablecoins. A stablecoin held directly by its user may still be subject to its issuer’s blocking mechanism. The custody arrangement and the design of the asset must therefore be considered together. ⁸⁹¹⁷

Method and scope

At a custodial platform, the custodian controls the account and signing means; Circle may apply its token restrictions under the implementation, its policy and applicable law. In self-custody, the holder controls signing means while token restrictions still apply. These powers can act on the same assets. The issuer lever illustrated concerns USDC rather than Bitcoin: action on Bitcoin can involve signing means or a custodian. The cited DarkSide announcement does not document how the FBI obtained the key. This generic model identifies no Arkéa-specific route, freeze or signing means; return still depends on established rights and the relevant authority.

The Colonial Pipeline case illustrates the role of keys. In June 2021, the US Department of Justice announced the seizure of 63.7 bitcoin linked to a ransom payment. Investigators had traced the transfers, and the FBI possessed the private key for the relevant address. The announcement established that possession while leaving the method of obtaining the key undisclosed. The trail directed the investigation; the ability to sign provided the means to act on the funds. ¹¹

This distinction also helps interpret a freezing announcement. Preventing further transfers keeps the asset available for the proceedings. The remaining work establishes who should receive it, through which procedure, and when they can actually use it.

In Maine, 737 days to a return announcement

A US federal case documents the legal steps leading to an announced return. On 6 March 2024, authorities seized 470,773 USDT, a stablecoin issued by Tether. The United States filed a civil forfeiture complaint on 17 January 2025. The District of Maine court entered a default decree of forfeiture on 25 June 2025, after notifications and the expiry of the periods for contesting the claim. ¹³

On 13 March 2026, the Justice Department announced that about US$470,735 would be returned to two victims. They had transferred more than US$800,000 in 2022. The department thanked Tether for helping effect the transfer of the assets. The seizure is stated in USDT; the announced return is stated in dollars. The two documents used here do not explain the numerical difference. ¹⁴

Method and scope

The axis represents calendar days elapsed since the March 6, 2024 seizure: 0, 317, 476 and 737 days for the four milestones. The civil forfeiture complaint was filed January 17, 2025; the court ordered forfeiture June 25, 2025; the DOJ announced a return to victims March 13, 2026. The seizure concerned 470,773 USDT and the announcement approximately 470,735 dollars for two victims. The units and amounts remain distinct. The cited records supply neither a final-credit date nor a usable explanation of the difference. This single case provides no average recovery time.

There were 737 days between seizure and the announcement of a return. That calculation measures one specific interval with documented endpoints. The statement does not give the date on which the victims’ accounts were finally credited. It also reports the original loss only as exceeding US$800,000, which leaves the exact recovery rate unknown.

An asset can be preserved for proceedings while its owner remains unable to use it. A company must meet its bills from other resources. An individual waits to regain spending power. Successful restraint and continued unavailability both belong in an assessment of recovery.

This American timeline describes a particular legal route. It raises a further question: can some legal systems return assets before forfeiture is complete?

The law also provides earlier routes back

In the European Union, Regulation 2018/1805 governs mutual recognition of freezing and confiscation orders between the member states concerned. Article 29 allows frozen property to be returned before confiscation, following a decision by a competent authority in the country requesting enforcement. The victim’s title must be uncontested, the property must not be required as evidence in criminal proceedings in the country enforcing the order, and the rights of affected persons must be protected. Article 30 deals with property already confiscated and with compensation. ⁶

French law also allows certain returns during an investigation. Article 41-4 of the Code of Criminal Procedure includes a route where ownership is not seriously disputed, subject to the limits in the provision. The point at which assets can be returned depends on the proceedings, the rights involved and the available evidence. ¹⁸

Eurojust examined these difficulties in a report published in October 2025. The agency describes prompt returns in some cases and lengthy obstacles in others, involving national practices and the conditions for restitution. Its observations show the work remaining after a freeze: transmitting an actionable decision, resolving competing claims, protecting third parties’ rights and arranging the transfer. ⁷

Crossing a border brings additional authorities, exchanges of information and sometimes different legal regimes. Cooperation can connect them. Its results should be assessed through the steps completed and funds actually delivered. The countries and decisions relevant to Arkéa have yet to be publicly documented in this research.

The next useful number from Arkéa

The next announcement needs to locate the money in the recovery process. An amount stopped before execution represents an avoided outflow. Funds frozen with an intermediary remain immobilised. Seized assets come under judicial control. A return makes resources available to their recipient again. Depending on the measurement date, several of these descriptions may refer to the same value.

Adding the stages together would inflate the result. Subtracting them from a poorly defined initial amount could manufacture an equally misleading residual loss. Useful disclosure would state the currency, date, scope and status of the sums, followed by the portion available again. The same discipline applies to public cryptoasset estimates whose coverage and valuations can change.

At the close of this collection, no detailed official amount of funds blocked or actually returned to Arkéa was found in the documents reviewed. ¹³²¹ That is a limit of the available public information. Recovery work may have advanced without further disclosure.

The next question is therefore concrete: among the institutions or authorities that received or secured funds, which can return them to the bank, under what authority and on what documented timetable? Recovery delivers its full economic effect when the money becomes usable again.

Method and scope

This documentary investigation is current to 6 November 2026. Arkéa’s communications are attributed to the bank and checked against Reuters where the agency reports the same elements. SEPA rules, European legislation and American court records explain general mechanisms. The diagrams do not reconstruct an assumed Arkéa payment route.

The Singapore and Maine cases are documented examples selected for publication by their sources. They provide neither a representative sample nor a predictive model. This work uses public documents, with no interviews, access to bank records, confidential data or technical investigation of an infrastructure. The references below identify the relevant passages and limits. The sharing image is a conceptual illustration of fund recovery.

Further reading

The economics of restarting after a cyberattack examines the dependencies involved in restoring a service. USDT freezing and seizure powers explores the roles of issuers and public authorities.

Sources

1. S01 · Crédit Mutuel Arkéa · 2026-11-04T17:30:00+01:00 · Accessed: 2026-11-06Informations complémentaires suite à l’attaque dont le Crédit Mutuel Arkéa a été victime
   Passages and scope

   Bank statements, questions 1, 2, 3 and 6; supplementary PDF dated November 4 at 17:30 Paris time. The bank describes its own account, an unnamed provider, possible cryptoasset conversion and an unquantified blocked portion. These are attributed statements by an interested party, not an independent technical audit.

   Additional document consulted

2. S02 · Crédit Mutuel Arkéa · 2026-11-04 · Accessed: 2026-11-06Crédit Mutuel Arkéa annonce avoir été victime d’une attaque
   Passages and scope

   Initial November 4 statement. Operational recovery and protection of customer assets are reported by the bank. The supplementary statement dates the initial communication to 13:00 Paris time.

3. S03 · Reuters · 2026-11-05 · Accessed: 2026-11-06French bank Credit Mutuel Arkea says €100 million missing after cyberattack
   Passages and scope

   Reuters report dated November 5, read in the full CNA republication. Approximately €100 million is a provisional estimate. The prosecutor’s investigation is reported by Reuters; no separate judicial statement was located in the reviewed material.

   Additional document consulted

4. S04 · European Payments Council · 2026-09-30 · Accessed: 2026-11-062025 SEPA Credit Transfer Scheme Rulebook, version 1.2
   Passages and scope

   Section 4.3.2.3, printed pages 31–34, especially CT-02.03. Fraud recall may be initiated within 13 months; the beneficiary PSP must respond within 15 Banking Business Days. Outcomes remain conditional. The rules do not establish which payment scheme was used in the Arkéa incident.

   Additional document consulted

5. S05 · European Payments Council · 2026-09-30 · Accessed: 2026-11-062025 SEPA Instant Credit Transfer Scheme Rulebook, version 1.2
   Passages and scope

   Sections 4.2.1–4.2.3 and 4.3.2.2, printed pages 39–42. The internal five-second target and statutory ten-second ceiling concern execution. Recall windows, response deadlines and the actual return of money are distinct.

   Additional document consulted

6. S06 · European Union · 2018-11-28 · Accessed: 2026-11-06Règlement (UE) 2018/1805 : reconnaissance mutuelle des décisions de gel et de confiscation
   Passages and scope

   Articles 29 and 30. The current consolidated reference is dated May 1, 2025; its direct reader triggered a JavaScript challenge. The relevant provisions were read in the original Official Journal text and corroborated by Eurojust. Cross-border recognition has a defined jurisdictional scope and restitution conditions.

   Additional document consulted

   Additional document consulted

7. S07 · Eurojust · 2025-10-06 · Accessed: 2026-11-06Report on Regulation 2018/1805 on the Mutual Recognition of Freezing and Confiscation Orders
   Passages and scope

   Report dated September 2025, page published October 6; chapter 8, pages 18–21. Judicial-practice observations, not a representative recovery rate or average waiting time.

   Additional document consulted

8. S08 · GAFI / FATF · 2026-03-03 · Accessed: 2026-11-06Targeted Report on Stablecoins and Unhosted Wallets: Peer-to-Peer Transactions
   Passages and scope

   Sections 52–58 and 62–67, printed pages 19–26. Public-ledger visibility, off-chain identities and issuer powers. These mechanisms do not confirm attribution of an Arkéa wallet.

   Additional document consulted

9. S09 · Circle · undated page · Accessed: 2026-11-06Understand Circle’s stablecoin blocklisting process
   Passages and scope

   Circle’s product documentation on USDC and EURC address blocklisting. Restrictions on future transfers differ from reversing a completed transaction; action depends on policy and applicable law. This is an issuer’s description of its own powers.

10. S10 · Bitcoin.org · undated page · Accessed: 2026-11-06Frequently Asked Questions
    Passages and scope

    Sections on Bitcoin’s operation and control. A public address and the ability to produce the required signature are distinct. Community technical documentation, without an asset-recovery guarantee.

11. S11 · US Department of Justice · 2021-06-07 · Accessed: 2026-11-06Department of Justice Seizes $2.3 Million in Cryptocurrency Paid to the Ransomware Extortionists Darkside
    Passages and scope

    June 7, 2021 seizure announcement: investigators traced 63.7 BTC and the FBI held the relevant private key. The source does not disclose how the key was obtained or give a final victim-credit date. The February 2025 webpage update is not the event date.

12. S12 · Singapore Police Force · 2026-10-29 · Accessed: 2026-11-06USD 12.8 Million Recovered From Business Email Compromise Scam Through Strong International Cooperation
    Passages and scope

    Official October 29, 2026 announcement, updated October 30: October 13 transfer and October 26 discovery/report. The police announce full recovery of US$12.8 million without dating the final credit. A selected case, not an average success rate.

13. S13 · US District Court, District of Maine / GovInfo · 2025-06-25 · Accessed: 2026-11-06United States v. 470,773 USDT, No. 2:25-cv-00017-LEW: Decree of Forfeiture
    Passages and scope

    Court decree, pages 1–2: seizure March 6, 2024; complaint January 17, 2025; default forfeiture June 25, 2025. The graphic omits personal and wallet identifiers unnecessary to the analysis.

14. S14 · US Department of Justice, District of Maine · 2026-03-13 · Accessed: 2026-11-06Department of Justice to Return $470,735 to Victims of Cryptocurrency Investment Scheme
    Passages and scope

    March 13, 2026 announcement of a planned return of approximately US$470,735 to two victims. The seizure was 470,773 USDT; the source gives no explanation of the numerical difference and no final credit date. A loss stated only as greater than US$800,000 prevents an exact recovery-rate calculation.

15. S15 · Swift · undated page · Accessed: 2026-11-06Stop and recall
    Passages and scope

    Swift’s description of its Stop and Recall service. Covers communication, tracking and stopping payments in flight, without proving use in the Arkéa incident or providing an independently verified effectiveness rate.

16. S16 · Bitquery, Gaurav Agarwal · 2026-11-02 (self-declared metadata) · declared revision 2026-11-05 · Accessed: 2026-11-06Investigation on flows associated with the reported EU crypto theft
    Passages and scope

    Commercial blockchain analysis; publication November 2 and revision November 5 are self-declared metadata, not independent historical proof of every version. The consulted reconstruction is not reconciled with confirmed bank debits. No Arkéa loss or recovery total is calculated from it.

17. S17 · UK Home Office · 2024-04-26 · Accessed: 2026-11-06Circular 005/2024: Economic Crime and Corporate Transparency Act, cryptoasset forfeiture provisions chapters 3C to 3F
    Passages and scope

    Paragraphs 29–40, especially 33. Government explanation of a defined England and Wales cryptoasset-forfeiture framework involving a UK-connected provider. Its conditions are not applied automatically to Arkéa or to other jurisdictions.

18. S18 · French Republic / Légifrance · 2024-09-30 (version effective date) · Accessed: 2026-11-06Code de procédure pénale, article 41-4
    Passages and scope

    French Code of Criminal Procedure, article 41-4. September 30, 2024 is the effective date of the referenced version. Restitution has conditions, competent authorities and refusal grounds, including disputed ownership and evidential requirements. The unpublished Arkéa proceedings are not diagnosed here.

19. S19 · European Union · 2024-03-19 · Accessed: 2026-11-06Règlement (UE) 2024/886 concernant les virements instantanés en euros
    Passages and scope

    Article 1 inserts article 5a(4)(c) into Regulation 260/2012. Ten seconds from receipt of the order by the payer’s PSP concerns execution, not fraud recovery.

    Additional document consulted

20. S20 · Swift · undated page · Accessed: 2026-11-06Swift accelerates transformation of consumer payments as banks roll out new framework for retail transactions
    Passages and scope

    About Swift section: the operator supplies messaging and does not hold customer funds or accounts. No commercial performance statistics are used.

21. S21 · Crédit Mutuel Arkéa · undated page · Accessed: 2026-11-06Information permanente
    Passages and scope

    Official permanent-information index consulted November 6. The reviewed incident notices are dated November 4. The absence of a new public total does not establish an absence of recovery work.

22. S22 · Lucie Robequain and Martin Untersinger / Le Monde · 2026-11-05T09:57:00+01:00 · Accessed: 2026-11-06European banks wake up to scale of vulnerability after cyberattack on French bank
    Passages and scope

    Original Le Monde reporting, November 5 at 09:57 Paris time. Kraken appears at the receiving end, distinct from the provider initially used to reach the bank. The reporting is not a bank ledger or an official total of money returned.