Key Takeaways
- Crédit Mutuel Arkéa said on November 4, 2026, that attackers used the bank's own account to send money to other banks, which potentially let them convert it into cryptocurrency through specialized platforms.
- Crédit Mutuel Arkéa did not confirm reports that 118 million euros ($133 million) was stolen in the November 2026 attack, but said it could validate the order of magnitude and that part of the funds had been blocked.
- On-chain investigator ZachXBT flagged the suspected theft on November 2, 2026, and later raised his estimate to more than $133 million in withdrawals from crypto exchange accounts, Decrypt reported.
- The Paris prosecutor's cybercrime section opened an investigation on November 4, 2026, after a complaint from Crédit Mutuel Arkéa, and assigned it to France's anti-cybercrime office (OFAC), AFP reported.
What happened
French banking group Crédit Mutuel Arkéa said on November 4, 2026, that it had been the victim of an attack that allowed fraudulent operations to be carried out. In a statement, the bank said the incident was closed and under control, and that operations were gradually resuming after the group put stronger security measures in place.
When it detected the attack, the bank informed the relevant supervisory authorities and temporarily suspended some transactions as a precaution to prevent further fraudulent movements, it said.
Crédit Mutuel Arkéa is made up of the Crédit Mutuel federations of Brittany and the South-West and their local branches, along with about 40 specialized subsidiaries, according to the bank. Those subsidiaries include the online bank Fortuneo, France 3 reported. The group, based near Brest, reported a net profit of 230 million euros for the first six months of the year, according to AFP.
How the money moved
In a second statement later on November 4, Crédit Mutuel Arkéa said the attackers used the bank's own account to make transactions to other banks. Those banks then potentially allowed the attackers to convert the money into cryptocurrency through specialized platforms, the bank said. It said the attackers did not go through the accounts of customers of its federations or subsidiaries.
The bank denied press reports that the attackers got in through Fortuneo. It said they went through the platform of one of its service providers and reached Crédit Mutuel Arkéa directly. The bank did not name the provider.
ZachXBT, an on-chain investigator who tracks public transactions on blockchains, first flagged the suspected theft. He reported suspicious movements from November 2, according to France 3. ZachXBT said an unnamed entity in the European Union may have lost more than $106 million from accounts at several crypto exchanges on November 1, withdrawn as the stablecoins USDC and USDT, Decrypt reported.
On November 3, ZachXBT named Crédit Mutuel Arkéa as the alleged victim. He raised his estimate to more than $133 million after finding a further $27 million in withdrawals, some of them made after his first post, according to Decrypt. He said the attacker then swapped the USDC for ether, converted some into the privacy coin Monero, and moved funds across multiple blockchains.
What the bank said about the amount
Asked whether 118 million euros ($133 million) had been stolen, Crédit Mutuel Arkéa said it did not confirm the figure and could only validate the order of magnitude. Part of the funds had been blocked, and other actions were under way to recover them, the bank said. AFP reported that the bank put the attack at about 100 million euros in a provisional estimate.
The bank said it was too early to give a final amount, but that the sums involved did not put its financial health or solidity in question. Customers' assets were not affected, and the incident only delayed some transfers, according to the bank.
Crédit Mutuel Arkéa said the attack was not caused by human error at the bank and described it as a sophisticated attack from outside that is now contained. It said its security systems identified the suspicious activity very quickly.
ZachXBT accused the bank of not making a proper incident disclosure, which he said kept law enforcement from freezing about $30 million in stolen funds, Decrypt reported.
Investigation and open questions
The cybercrime section of the Paris prosecutor's office received a complaint from Crédit Mutuel Arkéa on the morning of November 4 and immediately opened an investigation, AFP reported. The case covers unauthorized access to an automated data processing system by an organized group, and the prosecutor assigned it to France's anti-cybercrime office, the Office anticybercriminalité (OFAC), according to AFP.
The bank said its teams are working with judicial and police authorities to determine where the attack came from and how it was carried out. No one had claimed the attack, AFP reported. ZachXBT said the attacker has not been identified, but that he could say "with a high degree of confidence" it was not North Korea's Lazarus Group, based on laundering indicators, according to Decrypt.
The bank has not said how the attackers used the service provider's platform, and it is still assessing the final amount lost.
What customers should do
Crédit Mutuel Arkéa warned that phishing attempts, fake messages meant to trick people into handing over their details, are possible following the attack. The bank asked customers never to share personal or banking information such as login IDs, passwords, card numbers, or verification codes received by text message. Customers who are unsure about a message should contact their bank adviser directly to confirm it, the bank said.
The bank said the warning was a precaution, because attacks of this kind often bring a rise in phishing attempts that aim to obtain confidential data.