Attackers Drain About €100 Million From French Bank Crédit Mutuel Arkéa Through a Service Provider, Then Cash Out in Crypto
Crédit Mutuel Arkéa confirms a cyberattack let attackers move about €100M out of the bank's own account through a vendor platform; customers are unaffected and Paris prosecutors are investigating.
What Happened
French bank Crédit Mutuel Arkéa confirmed on 4 November 2026 that it was hit by a cyberattack that let criminals make fraudulent transfers out of the bank's own account. The bank put the losses at around €100 million (about $112 million). It would not give an exact figure, saying the amount is "still being evaluated." It said it could only confirm the order of magnitude.
The theft first came to light publicly on 2 November, when an independent on-chain investigator flagged large flows of stolen money moving through crypto platforms. That investigator put the losses at more than $133 million (around €118 million) and warned the figure could rise, because the attack played out over several days. Regional press later reported a similar number. Arkéa has not confirmed that figure.
The bank called it "a sophisticated attack coming from the outside" and ruled out human error by its staff.
How the Attackers Got In
Arkéa says the attackers reached its systems through the platform of one of its service providers. The bank has not named the provider. It also denied reports that the breach came through Fortuneo, its online banking subsidiary.
Once inside, the attackers used the bank's own account to send transfers to accounts at other banks. The bank has not said how long the attackers had access, which systems were compromised, or who it believes is behind the attack.
Where the Money Went
The stolen money did not stay in the banking system for long. Arkéa says the transfers may have allowed the money to be converted into cryptocurrency on specialised platforms. According to the on-chain investigator, the money went through several accounts opened on crypto exchanges. The attacker swapped stablecoins for ether and then bridged the assets across multiple blockchains, a common way to make stolen funds harder to trace and freeze.
Part of the money has been blocked, and the bank says recovery efforts are ongoing. Arkéa has not linked its transfers to specific wallets, so the full path of the money is still unconfirmed.
Impact on Customers
Arkéa says no customer accounts were involved, customer holdings are safe and no client will lose money. As a precaution, the bank suspended some transactions while it secured its systems, which delayed some transfers. Nearly all operations resumed on 4 November after security checks and extra safeguards were put in place.
The bank also stressed that the loss will not threaten its financial strength. For scale, Arkéa reported a net profit of €230 million in the first half of the year, has total assets of about €211.5 billion and serves more than 5.8 million members and customers, mainly in western France.
The Investigation
The Paris public prosecutor's office has opened an investigation into an "attack on an automated data processing system by an organised group." Arkéa says it is working with the relevant regulators, judicial authorities and supervisors to find the source of the attack.
Why It Matters
Most bank cyber incidents are data breaches: leaked customer records, ransomware and service outages. This one is different. Attackers moved roughly €100 million of the bank's own money and turned much of it into cryptocurrency within days. That is closer to the bank heists that once targeted payment messaging systems than to a typical ransomware case.
Three points stand out:
- Third parties are the way in. Once again the entry point was a service provider, not the bank's own front door. Banks can harden their own systems and still be exposed through a vendor platform that has trusted access to payment functions.
- Crypto off-ramps are fast. The time between a fraudulent transfer and the money being on a blockchain is now very short. Once funds are swapped and bridged across chains, freezing them depends on how quickly exchanges and issuers act.
- The customer and the institution are not the same victim. Customers were protected here, but the bank itself carried the loss. Treasury and nostro accounts, not just retail accounts, need strong transaction monitoring.
What Banks and Financial Firms Should Do Now
- Map vendor access to payment systems. List every third party whose platform can start, approve or change transfers, and check what access they really have.
- Require out-of-band approval for large outgoing transfers from the institution's own accounts, especially new beneficiaries and unusual destinations.
- Watch for slow-burn patterns. This attack ran over several days. Alert on a run of transfers to new counterparties, not just single large payments.
- Build crypto-exchange contacts into incident response. Know in advance how to reach exchange compliance teams and stablecoin issuers to request freezes within hours.
- Rehearse a "funds are moving now" scenario with treasury, fraud, security and legal teams together, so that blocking, recall requests and law-enforcement notification happen in parallel.
Analyst Take
Arkéa reacted quickly. It contained the incident, blocked part of the funds, resumed operations within days and protected customers. But the central lessons are uncomfortable for the whole sector. A trusted service provider became a path to the bank's own money, and the stolen funds were converted into crypto before anyone could stop all of it. Expect regulators across Europe to ask harder questions about third-party access to payment functions in the coming months.
