A major cyberattack on French banking group Crédit Mutuel Arkéa allowed attackers to carry out fraudulent transfers worth around €100 million. The incident exposed a route into the bank through an external service provider, but the company involved and the exact method used by the attackers remain unknown.
The bank says its own account was used to move the money. Customer accounts were not the entry point, and Arkéa says customers’ assets were not affected.
The attack was contained, but the incident has raised serious questions about how criminals can exploit trusted connections between financial institutions and the outside companies that provide their services.
How the attack came to light
The first public warning came from blockchain investigator ZachXBT on 2 November 2026. He reported that an unidentified European entity had lost more than $106 million through withdrawals from several cryptocurrency exchange accounts.
A day later, he increased his estimate by more than $27 million after identifying additional withdrawals. He then named Crédit Mutuel Arkéa as the suspected victim.
At that stage, the bank had not publicly confirmed that it was involved. The early figures came from blockchain investigations, not from an official loss statement by Arkéa.
On 4 November, the bank confirmed that it had suffered a cyberattack involving fraudulent transactions. It said the incident had been contained and that it was working with the relevant authorities.
The following day, Reuters reported that the amount stolen was estimated at around €100 million, or approximately $112.6 million. Arkéa has not confirmed the higher €118 million figure that appeared in some early reports. The bank said it could confirm the order of magnitude while its assessment continued.
This distinction matters. The reported €100 million is an estimate, not a final audited figure published by the bank.
How did the attackers reach the bank?
Arkéa’s explanation points to an external service provider.
In its additional statement on 4 November, the bank said attackers used the platform of one of its service providers to reach Crédit Mutuel Arkéa directly.
The bank did not name the provider or explain the technical weakness that allowed the attackers to use its platform. Arkéa described the incident as a sophisticated external attack and rejected human error within the bank as the cause. However, this does not explain how the authorised third party’s computer was compromised or identify the weakness the attackers exploited.
Further reporting from Le Monde on 5 November added an important detail. The newspaper reported that attackers compromised the computer of a third party who had authorisation to carry out transactions. That access reportedly allowed them to reach the bank’s systems and its own funds.
This is a significant part of the reported attack route, but it does not identify the supplier or establish exactly how the computer was compromised. The available reporting does not confirm whether the attackers used stolen credentials, malware, a software vulnerability or another technique.
A service provider is an outside company that supplies a bank with technology or services. Depending on the arrangement, its platform or authorised users may have access to systems involved in important business operations.
That connection can become a security risk if attackers gain control of an account, device or system that the bank trusts.
The incident therefore raises a wider question for financial institutions: how securely are third-party platforms and authorised access monitored when they can reach sensitive banking operations?
Was Fortuneo involved?
Arkéa specifically rejected reports that attackers entered through Fortuneo, its online banking subsidiary.
In its 4 November clarification, the group said there was no entry through Fortuneo. Instead, attackers used the platform of one of its service providers to reach Arkéa directly.
The bank also said the fraudulent transfers did not pass through the accounts of customers of its banking federations or subsidiaries.
It is important to distinguish between the route used to gain access and the account used to move the money. Arkéa’s public explanation identifies the service provider’s platform as the route into the bank. It says the attackers then used an account belonging to Crédit Mutuel Arkéa itself.
How was the money moved?
According to the bank, attackers used an account belonging to Crédit Mutuel Arkéa to make fraudulent transfers to other banking institutions.
The money was not stolen in cryptocurrency in the first place. Arkéa said the transfers were made through the banking system and that the funds may then have been converted into cryptocurrency through specialist platforms.
That distinction is important because early coverage focused heavily on the cryptocurrency movements. The bank’s explanation makes clear that the original theft involved money transferred from its own account.
Blockchain investigators subsequently tracked funds moving through cryptocurrency exchange accounts and digital wallets.
Bitquery separately traced substantial USDC withdrawals from accounts associated with Kraken, Crypto.com and OKX over a period spanning 1 and 2 November. Its analysis provides information about the movement of cryptocurrency, but blockchain records alone do not establish the bank’s final accounting loss.
The early estimate of more than $133 million came from ZachXBT’s investigation. It should not be treated as a confirmed final loss or added to the approximately €100 million figure reported later. They are different estimates of the same incident, not separate amounts stolen.
Some funds were reportedly blocked, and recovery efforts were under way. However, the full amount recovered has not been established in the public information reviewed for this article.
Were customers’ accounts, money or data affected?
Crédit Mutuel Arkéa says customers’ assets were not affected.
The bank stated that attackers used its own account rather than customer accounts belonging to its banking federations or subsidiaries.
However, that does not establish whether any customer information was accessed or taken. The bank’s public statements focus on the protection of customer assets, and Reuters reported that Arkéa had not confirmed whether data was taken. There is therefore no verified basis to say that customer data was either stolen or unaffected.
The bank temporarily suspended certain transactions as a precaution after detecting the attack. This caused delays to some transfers while the group checked its systems and introduced additional security measures.
Arkéa said the incident had been contained and that almost all operations had resumed after those checks.
Customers should also be cautious about unexpected calls, emails or text messages claiming to offer information about the attack or asking them to verify their banking details. Never share passwords, card details or one-time verification codes in response to an unexpected request. Contact the bank through its official channels if a message or call seems suspicious.
Who was responsible, and which supplier was involved?
The attackers have not been publicly identified, and Crédit Mutuel Arkéa has not named the service provider whose platform was used to reach the bank.
Le Monde reported that the attackers compromised a computer belonging to a third party authorised to carry out transactions. However, the newspaper did not identify the company or explain how the computer was compromised.
There is also no publicly confirmed evidence establishing that a particular criminal group was behind the operation. Suggestions about possible organised-crime involvement or an insider remain possibilities discussed by sources, not established findings.
Arkéa says it is working with judicial and law-enforcement authorities to determine the origin and precise method of the attack. Until investigators or the bank publish further verified details, the identity of the attackers, the supplier and the exact access technique remain unconfirmed.
France has opened an investigation
The Paris public prosecutor’s office opened an investigation after receiving a complaint from the bank. AFP reported that the investigation concerns an attack on an automated data-processing system by an organised group.
France’s cybercrime police are handling the investigation.
Arkéa said it had informed the relevant authorities and supervisory bodies. It also said its teams were working with judicial and law-enforcement authorities to establish precisely how the attack happened.
The investigation will need to establish how the attackers gained access, how the service provider’s platform was used, who controlled the fraudulent activity and how much money can be recovered.
Those answers have not yet been made public.
What this attack means for other banks
The incident is a reminder that a bank’s security does not depend only on the systems it owns and operates.
Financial institutions also rely on outside companies, software platforms and authorised third parties. Those connections can provide attackers with another route towards sensitive systems if access is not properly protected and monitored.
The reported compromise of a computer belonging to an authorised third party makes the issue particularly important. A device or account with legitimate access can become a serious risk if criminals take control of it.
The case also raises questions about how large transfers are checked and whether unusual movements can be stopped quickly enough. Cybersecurity experts quoted by Le Monde questioned why controls designed to detect unusually large financial movements did not prevent the loss.
The investigation may eventually explain which safeguards failed and whether the incident exposed weaknesses that other banks should address.
For now, the confirmed facts are serious enough without speculation: attackers reached Crédit Mutuel Arkéa through a service provider’s platform, used the bank’s own account to make fraudulent transfers and caused a loss estimated at around €100 million.
The bank says customer assets were not affected and that the incident has been contained. But the supplier’s identity, the attackers and the precise method used to gain access remain unanswered questions.
We reviewed Arkéa’s official statements and reporting from Reuters, AFP and Le Monde. Blockchain analysis was also considered for reported fund movements. Confirmed facts are separated from unverified details, including the supplier’s identity and the exact access method.
Community discussion
Join the conversation
0 comments
Be the first to join in
There are no comments yet. Sign in to start a thoughtful discussion.
Sign in to comment
Join the conversation with your Secritic account. Comments are available to signed-in readers.