French bank confirms heist; attackers used third-party supplier, bank says

Crédit Mutuel Arkéa confirmed on Nov. 4, 2026 that a cyber attack enabled fraudulent transactions. The bank said attackers entered through an unnamed third-party service provider platform and moved funds from the bank’s own accounts to other institutions. The bank called the intrusion sophisticated and said human error was not the cause.

The attackers used Crédit Mutuel Arkéa's own account to carry out transactions to other banking institutions

Crédit Mutuel Arkéa statement, The Record

ZachXBT put total losses at more than $133 million, citing cryptocurrency exchange withdrawals and the laundering trail. He first flagged suspicious withdrawals of more than $106 million on Nov. 2 from accounts at several crypto exchanges on Nov. 1, then identified $27 million more in exchange withdrawals on Nov. 3, after his initial public disclosure, which pushed his estimate above $133 million. ZachXBT said the final loss could exceed $133 million because over-the-counter transactions—trades done directly between parties rather than on public exchanges—may not appear in traced blockchain activity.

Disclosing the EU financial institution exploited for $133M+ is allegedly Credit Mutuel Arkea

ZachXBT, Decrypt

Press reports put the theft at around EUR 118 million, or roughly USD 133 million, a figure the bank has not confirmed. The bank would not confirm the exact loss figure but said it could confirm the order of magnitude.

On Nov. 4, 2026, the bank denied that the breach originated through Fortuneo, its online banking subsidiary, disputing earlier reporting that linked the fraud to Fortuneo. Local French media reports had alleged Fortuneo was the entry point, a claim the bank disputed.

The method of compromise remains unknown. Available information does not establish how attackers first got in, whether a specific software flaw was used or whether stolen credentials played a role. On-chain data by itself cannot reveal whether the initial breach began with stolen credentials, social engineering, compromised internal systems or another vector. The bank’s teams are working with judicial and police authorities to pin down the attack’s origin and method of operation.

Funds were withdrawn as USDC and USDT from crypto exchange accounts. USDC was swapped for ETH, funds moved through instant exchanges, some assets converted into a privacy coin, and holdings bridged across multiple chains. ZachXBT documented the use of instant exchanges, cross-chain bridges and services that converted assets into Monero, and published four Ethereum addresses tied to the theft, he said.

Bitquery separately traced about $108.8 million in USDC withdrawals tied to Kraken, Crypto.com and OKX over roughly 21 hours on Nov. 1 and 2. The analysis counted 178 transactions across 15 wallets, including $62.98 million in stablecoins that the attackers converted into 27,553 ETH in about four hours.

Some converted assets were frozen and the bank is working to recover the remainder, though the final loss remains under assessment. ZachXBT warned that more than $30 million that could have been frozen had already moved beyond straightforward recovery channels. Crypto.com reportedly blocked funds linked to the incident, though the amount was not disclosed.

ZachXBT said he is highly confident that North Korea’s Lazarus Group was not responsible, citing differences in laundering behavior. No law-enforcement agency has publicly named the attacker, and the bank has not disclosed who it believes carried out the breach.

high degree of confidence

ZachXBT, FinanceFeeds

Arkéa notified supervisory and judicial authorities right after detecting the attack and temporarily suspended certain transactions to block further fraudulent movements, which delayed some transfers. The bank said no customer accounts were accessed and that customer assets were unaffected.

The bank said the incident is closed and under control, and operations were resuming gradually following stronger security measures and added verification steps. Security checks were completed and enhanced protective measures put in place before operations were gradually restored. The bank said it continues to assess the attack’s consequences and to strengthen security controls.

The bank said the amounts at stake would not endanger its solvency or financial health, seeking to reassure markets about its balance sheet. It also told customers to be alert for phishing attempts after the attack.

The bank reported total assets of €211.5 billion and a customer base of over 5.8 million members and customers. Its operations span Brittany and southwestern France through regional banking federations and roughly 40 subsidiaries. Its most recent annual report lists total assets above £237 billion, while ZachXBT described Crédit Mutuel Arkéa on Telegram as a French bank holding $235 billion in assets.

In May, the bank applied for a MiCA license to offer crypto services, according to earlier reporting. The services were to be delivered as a white-label offering through Arkéa Banking Services. Days before the Arkéa allegations, a $6.3 billion Binance hack that the FBI tied to North Korean hackers took place.

Earlier reporting described BREEZE COMET intrusions at financial firms that abused trusted access to move funds without authorization. No evidence ties that cluster to the Arkéa incident.