Crédit Mutuel Arkéa, a regional French bank based in Brittany, has confirmed what it calls a "sophisticated attack coming from the outside". Attackers got in through the platform of an unnamed service provider and used the bank's own account to send fraudulent transfers to other banks. The money was then likely converted into cryptocurrency. Estimates of the loss vary. Blockchain investigator ZachXBT, the regional newspaper Le Télégramme and CoinDesk put it at about $133 million (€118 million). AFP reports the bank put the fraudulent transactions at around €100 million ($112 million). Arkéa told The Record and franceinfo that it would not confirm the $133 million figure but could "validate the order of magnitude". Reuters, as carried by Cybernews, reports the bank said losses were below $133 million. The bank says customer accounts were not touched and customers will lose nothing. The Paris public prosecutor's office has opened a criminal investigation.
What Happened
ZachXBT, an anonymous American investigator who tracks funds on the blockchain, made the theft public on Monday, 2 November. He later named Arkéa as the victim. He said the attack ran over several days and that the stolen funds moved through several accounts opened on cryptocurrency exchanges. His estimate of more than $133 million was based on withdrawals from those exchange accounts and on transactions meant to launder the assets.
Arkéa confirmed the incident in a statement on Wednesday, 4 November, and gave more detail in a second statement that evening. The bank says:
- The attackers "went through the platform of one of our service providers" to reach the banking group directly.
- They used "Crédit Mutuel Arkéa's own account to carry out transactions to other banking institutions, which then potentially allowed them to convert this money into cryptocurrency via specialised platforms."
- Human error at Arkéa did not cause the attack.
- The incident is "contained" and "under control".
- As a precaution, the bank temporarily suspended some transactions. Some customer transfers were delayed as a result.
- Some of the converted funds have been frozen, and other recovery efforts are under way.
There are two points where accounts differ:
- The entry point. French media reported that the attackers got in through Fortuneo, Arkéa's online banking subsidiary, and made the first transfers from there. Arkéa denies this and says nothing entered through Fortuneo.
- The timeline. ZachXBT describes an operation that lasted several days. Arkéa says its security systems spotted the suspicious activity "very quickly". The bank has not said when the intrusion began or when it was detected. Reuters reports the bank did not answer questions on either point.
AFP reports that the Paris prosecutor's investigation covers an "attack on an automated data processing system by an organised group". Arkéa has not said who it thinks is behind the attack, and no group has claimed it.
What Was Taken
The loss is the bank's own money, not customer data or customer funds. The estimates are:
- About $133 million / €118 million: ZachXBT, Le Télégramme and CoinDesk, based on tracing funds on the blockchain.
- About €100 million / $112 million: the figure AFP attributes to the bank.
- "Order of magnitude" confirmed, no exact figure: Arkéa's statement as reported by The Record and franceinfo. The bank says it is "still too early to give a final figure".
Arkéa says the loss is "not of a nature to undermine the Group's financial strength and soundness". For context, AFP notes the bank made a net profit of €230 million in the first half of 2026. If the higher estimate is right, the theft equals about half of that profit.
On data, Arkéa says customer accounts in its regional federations and subsidiaries were not accessed. Reuters reports the bank did not respond when asked whether any data was stolen. The bank also declined to tell Reuters whether the stolen funds were held in cryptocurrency, as CoinDesk had reported.
Why It Matters
Attackers went after the bank's own money, not its customers. Most bank fraud targets customer accounts, where per-account limits, fraud scoring and customer complaints tend to catch abuse. This attack used the institution's own account to send money to other banks. Corporate treasury and settlement accounts often move large sums routinely, so large unusual transfers can blend in more easily.
The entry point was a supplier. Arkéa says the attackers came "through the platform of one of our service providers". The bank has not named the provider or said what service it offers. That matters for other banks: if the provider serves more than one institution, others could be exposed through the same route. Until the provider is named, banks cannot easily check whether they use it.
Cryptocurrency was the cash-out route. The stolen funds were moved from regular banking into crypto exchange accounts, which is the main way such money gets laundered. The fact that some funds were frozen shows exchange cooperation and blockchain tracing can work. It also shows they are not enough on their own to stop most of the money from leaving.
French finance is seeing several incidents at once. Cyberattaque.org reports that online broker Bourse Direct exposed names and IBANs of 800 customers in an intrusion on the night of 27 to 28 October. It also reports that a hacker calling themselves "Alduin" published 3,848 records from the French bancassurance intermediaries' association AFIB on 3 November, claiming to have used an access-control flaw in its API. Nothing so far links these incidents to Arkéa. Separately, AFP and Reuters report that European companies are on alert after a wave of attacks on internet-connected fridges and freezers, including at three regional blood banks in France.
The Attack Technique
Few technical details have been released. Here is what is known and what is not.
Confirmed by the bank: - The first access came through a third-party service provider's platform, not through Fortuneo and not through customer accounts. - The attackers were able to start outgoing transfers from Arkéa's own account to other banks. - The bank says the attack did not depend on a mistake by its own staff.
Reported by others: - ZachXBT says the funds passed through several accounts opened on crypto exchanges, and that the operation lasted several days.
Not disclosed: - How the provider was compromised, for example through stolen credentials, a software vulnerability or a malicious update. - What access the provider's platform had to Arkéa's payment systems, for example a payment hub, an API connection or a back-office tool. - How the transfers got past payment authorisation controls. - When the attack started and when it was detected.
From what the bank has said, the attackers got trusted access through the supplier, issued payment orders that Arkéa's systems treated as legitimate, sent the money to accounts they controlled at other banks, and then moved it into crypto. That pattern matches past attacks on payment systems where intruders took over legitimate payment workflows. Until Arkéa or the prosecutor releases more, how the payments were authorised is speculation.
What Organizations Should Do
-
List every supplier that can start or approve payments. Identify every third-party platform with a path to your payment, treasury or settlement systems, including through APIs, file transfers or managed services. Treat each one as a direct way into your money.
-
Put strict controls on your own corporate accounts. Require independent approval by two people for high-value or unusual outgoing transfers from treasury accounts. Use velocity limits and allowlists of approved beneficiaries. Alert on transfers to new beneficiaries, especially at banks you rarely deal with.
-
Don't let supplier connections send payments without a second check. Payment instructions arriving through a third-party platform should be checked separately inside your bank before money moves. Being authenticated as the supplier should not be enough. Restrict each supplier connection to the specific actions it needs.
-
Watch for laundering patterns on outgoing money. Monitor transfers to banks and payment providers that serve cryptocurrency exchanges. Build working contacts with major exchanges and blockchain analytics firms now, so you can ask for freezes within hours rather than days.
-
Assume a breach can run for days. ZachXBT's account suggests the activity went on over several days. Check whether your monitoring would catch a slow series of fraudulent transfers, not only one large one. Review logs of payment approvals daily, not just at month-end reconciliation.
-
Plan to halt payments without disrupting customers. Arkéa says it suspended some transactions to stop further losses. Prepare and test how to quickly freeze outgoing payments from specific accounts or channels while keeping customer services running.
Sources: French bank confirms cyber heist, hackers suspected to ... | French bank says cyberattack stole around $100 mn AFP.com | French regional bank says cyberattack caused 'fraudulent transactio... | Des millions d'euros volés, une attaque inédite, une enquête ouvert... | Credit Mutuel Arkea cyberattack: bank says customer assets safe Cy... | Bourse Direct victime d’une cyberattaque : les IBAN de 800 clients... | AFIB : près de 3 800 professionnels de la banque et de l’assurance... | Fraude chez Crédit Mutuel Arkéa : la banque en dit plus sur la cybe...