Crédit Mutuel Arkéa cyber heist: up to €118 million stolen via a service provider, bank says

Crédit Mutuel Arkéa, a French cooperative bank with more than 5.8 million members and customers, says it was hit by an attack that allowed fraudulent transactions. Blockchain investigator ZachXBT estimates the haul at up to about €118 million (roughly $133 million, per BleepingComputer's conversion), moved out as USDC and USDT stablecoins. The bank has not confirmed that number, but says it "can only validate the order of magnitude", and says customer assets are not affected.

Key points

• Crédit Mutuel Arkéa announced on 4 November 2026 that it had been the victim of an attack that allowed fraudulent operations; it said the incident was closed and under control and that customer assets were not affected.
• ZachXBT estimated the theft at up to about €118 million (about $133 million), withdrawn as USDC and USDT; the bank has not confirmed the figure, saying it could only validate the order of magnitude.
• The bank says the attackers got in through a service provider's platform and used the bank's own account, not customer accounts, to send transfers to other banks. It has not named the provider.
• The bank says the amounts involved are not of a nature to threaten its financial soundness, and that some funds have been frozen.
• The cause, the attacker and the final loss are all unconfirmed; the bank says its work with judicial and police authorities continues.

What happened

Crédit Mutuel Arkéa announced the attack in a press release dated Brest, 4 November 2026. It said that the group had been the victim of an attack that allowed fraudulent operations, that it had informed the competent authorities and supervisors as soon as it detected the attack, and that it had temporarily suspended certain transactions as a precaution to prevent any further fraudulent movement. Operations were resuming progressively that morning after checks and reinforced security measures. The bank said the incident had caused only the deferred execution of certain transfers, and that the amounts affected, still being assessed, were in any case not of a nature to call into question the group's strength and financial health.

The public trail began earlier. According to BleepingComputer, ZachXBT reported unauthorised withdrawals from multiple centralised exchange accounts around 1 November, publicly flagged the incident on 2 November without naming the victim, and said on 3 November that about $30 million had already been laundered before European law enforcement could freeze it. His estimate of the total was up to €118 million (about $133 million), in USDC and USDT.

The Record reports that the bank would not confirm that figure but said it could "validate the order of magnitude", and that the final loss has not been established. Both outlets say some of the converted funds have been frozen and that the bank is working to recover the rest.

On method, the bank's account as relayed by the two outlets is that attackers compromised an unnamed service provider or supplier and used that route to reach the bank's systems directly. They then used Arkéa's own account to send transfers to other banks, which may have let the money be converted into cryptocurrency on specialised platforms. The bank described the attack as "sophisticated" and ruled out human error. It denies French media reports that the entry point was Fortuneo, its online banking subsidiary.

Background

Crédit Mutuel Arkéa is made up of the Crédit Mutuel de Bretagne and Crédit Mutuel du Sud-Ouest federations, their local branches and about forty specialised subsidiaries, among them Fortuneo, Monext, Arkéa Banque Entreprises et Institutionnels, Arkéa Asset Management and Suravenir. In its press release it gives 12,073 employees and a balance sheet total of €211.5 billion. Against that, even the largest estimate is a small share of its assets, which fits the bank's own statement about solvency; the loss is, however, large for a cyber theft and unusual because it was taken from the bank's own funds and not from customers.

The method matters more than the sum. A service provider with a connection into a bank's payment systems is a trusted party; if its platform is compromised, the attacker inherits some of that trust. Moving the money into stablecoins and across exchanges is then a way to make it hard to recall. We covered a related pattern this week in the Binance $6.3 billion hack, where a human-factor entry point (a fake job offer) was followed by large crypto movements.

The numbers

The sums come from different parties and are not the same kind of figure, so we show them side by side.

type: bar
title: Reported size of the Crédit Mutuel Arkéa theft
unit: US$ million
source: BleepingComputer, citing ZachXBT (about $133 million for up to EUR 118 million; about $30 million laundered by 3 November)
highlight: Estimated total
Estimated total (ZachXBT, up to EUR 118M) | 133
Laundered by 3 November (ZachXBT) | 30

The €118 million figure and the $30 million laundered figure are ZachXBT's estimates, relayed by BleepingComputer. The bank's own statements give no figure; it speaks only of an order of magnitude and says the final amount is not yet known. We have not seen the exchange or address data behind ZachXBT's estimate, and the dollar conversion is BleepingComputer's.

What it means

For banks, the message is about third parties. The bank said the attack came through a provider's platform and used the bank's own account, so the weak point was a supplier connection, not customer logins. Banks and payment firms should review which vendors can initiate or influence transfers, what limits and approvals apply to those paths, and how quickly a sudden outflow to exchanges would be noticed. Those are our suggestions, not findings from the bank.

For customers, the bank says nothing changes for their balances, and that some transfers were delayed. It warns that phishing attempts are possible after the attack and tells customers never to share personal or banking details, identifiers, passwords, card numbers or SMS codes, and to confirm any doubtful message by contacting their bank adviser directly.

For the crypto industry, the case shows how quickly stolen funds can be converted into stablecoins on centralised exchanges, and how freezing depends on speed. Some funds were frozen, but ZachXBT said roughly $30 million had been laundered before European law enforcement could act.

What we don't know yet

• The final loss. The bank has not confirmed any figure, and ZachXBT's estimate is an outside one.
• Who the attackers are, and how exactly they compromised the service provider.
• Which service provider was involved. The bank has not named it, and we have not named one.
• Whether Fortuneo played any role. The bank denies it, citing the French media reports it disputes.
• How much will be recovered. The bank is working on it and some funds are frozen.
• Which authorities are leading the case. The bank says it is working with judicial and police authorities; we did not find a prosecutor's statement we could check.

What to watch next

Watch for the bank's next communication, which it promised once new information is available, and for any statement naming the provider or setting the loss. Customers of Arkéa group brands should treat unexpected calls, texts and emails about their accounts with care, as the bank has warned. Other banks that use the same provider, if it is ever identified, will be the next to need answers.

Sources

• Primary: Crédit Mutuel Arkéa press release, 4 November 2026 (PDF, in French)
• BleepingComputer, "Hackers pull off $133 million French bank heist via service provider"
• The Record, "French bank confirms cyber heist"