French banking group Crédit Mutuel Arkéa has confirmed a cyberattack that allowed criminals to transfer substantial funds from the institution’s own accounts. The intrusion originated through a third-party service provider, highlighting how weaknesses outside a bank’s infrastructure can expose financial systems to serious security threats.
The incident became public in early November 2026, when blockchain investigator ZachXBT reported suspicious withdrawals involving cryptocurrency exchange accounts. He estimated that attackers had stolen approximately €118 million ($133 million), although the bank has disputed that figure and has not established its final losses.
Crédit Mutuel Arkéa acknowledged the attack on November 4, describing it as a sophisticated operation. The institution, which serves approximately 5.8 million customers and holds €211.5 billion in assets, said the incident had been contained and that recovery efforts were underway.
According to the bank, the attackers gained access through a platform operated by an external service provider. Once inside, they were able to initiate unauthorized transactions using Crédit Mutuel Arkéa’s own account, transferring money to other financial institutions.
The stolen funds may subsequently have been converted into cryptocurrency through specialized platforms. ZachXBT reported that the attackers withdrew assets using the USDC and USDT stablecoins and claimed that approximately $30 million had already been laundered by November 3. These findings have not been independently confirmed by the bank.
Crédit Mutuel Arkéa rejected speculation that its online banking subsidiary Fortuneo was responsible for the intrusion. It also ruled out human error within the banking group, although the precise technical method used to compromise the service provider has not been disclosed.
The institution confirmed that some of the affected funds had been blocked and that additional recovery measures were in progress. It acknowledged that the sums involved were significant but maintained that the losses would not threaten its financial stability.
Importantly, the attackers did not access individual customer accounts to execute the fraudulent transfers. The bank said customers’ assets remained unaffected, although precautionary restrictions temporarily delayed certain transactions.
Following the discovery, Crédit Mutuel Arkéa activated its incident response procedures and suspended parts of its systems to prevent further unauthorized activity. Banking operations subsequently began returning to normal under strengthened security controls.
The organization is cooperating with police and judicial authorities to determine how the attackers entered its systems and identify those responsible. No suspects have been publicly named.
The bank has also warned customers about potential phishing attempts exploiting publicity surrounding the incident. Fraudsters may impersonate bank representatives and request passwords, payment card details, or authentication codes.
While the investigation continues, the exact financial damage remains uncertain. The reported $133 million figure is an external estimate rather than a confirmed loss, and Crédit Mutuel Arkéa has not announced how much of the transferred money it expects to recover.