French cooperative banking group Crédit Mutuel Arkéa has confirmed a cyberattack that allowed fraudulent transfers out of the bank’s own account, with independent reporting putting the loss at roughly €118 million ($133 million). The Brest-based group said on November 4, 2026 that the incident is under control, that part of the money has been blocked, and that no customer has lost any funds.
Arkéa declined to confirm the €118 million figure first reported by the regional newspaper Le Télégramme, stating in a follow-up press release that it “can only validate the order of magnitude.” The group said the amounts involved are “in no way of a nature to undermine the financial strength and soundness” of the bank, which reports €211.5 billion in total assets and more than 5.8 million members and customers.
Attackers came in through a service provider
According to Arkéa, the attackers “went through the platform of one of our service providers and thereby reached Crédit Mutuel Arkéa directly.” The bank has not named the provider or described the weakness that was exploited. It also rejected early reports that the intrusion started at its online bank Fortuneo, stating there was no “entry” through Fortuneo.
Once inside, the attackers used Arkéa’s own account to send transfers to other banks, which “may then have enabled them to convert the money into cryptocurrency via specialised platforms.” Because the money came from the group’s own funds, the accounts of customers at its federations and subsidiaries, including Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest and Fortuneo, were not used.
The bank denied that human error on its side caused the incident, calling it “a sophisticated attack from outside, which has now been contained.”
Funds traced through crypto exchanges
The theft was first flagged publicly by an independent blockchain investigator, who reported on November 2 that more than $106 million had been withdrawn from centralized crypto exchanges before later raising the estimate to more than $133 million and naming Arkéa as the suspected victim. Blockchain analytics data showed about $108.8 million in USDC stablecoin withdrawn from accounts at Kraken, Crypto.com and OKX over roughly 21 hours on November 1 and 2, with much of it swapped into ether and split across hundreds of wallets.
According to the investigator, part of the money was then pushed through instant swap services and converted into Monero, a privacy coin whose transactions hide the sender, recipient and amount, which makes recovery far harder. The investigator said he had a high degree of confidence that North Korea’s Lazarus Group was not behind the theft, citing differences in how the funds were moved. No group has claimed the attack and no attribution has been made by authorities.
Several exchanges have acted on linked accounts. Kraken said it had restricted accounts suspected of involvement and was working with authorities, and Crypto.com said it had blocked funds linked to the incident from moving through its platform, franceinfo reported. OKX separately said it froze an institutional customer account after identifying unusual activity.
Transfers paused, then resumed
In its first statement on November 4, Arkéa said it had temporarily suspended certain transactions as a precaution to prevent any new fraudulent movements. Customers saw delayed transfers, and the group’s mobile app was reported unavailable for much of the day. The bank said almost all operations resumed during the morning after verifications and enhanced security measures were put in place.
Paris prosecutors open an investigation
The cybercrime section of the Paris prosecutor’s office received a complaint from Arkéa on November 4 and immediately opened an investigation into intrusion into an automated data processing system by an organized group, according to AFP and Euronews. The case has been assigned to France’s anti-cybercrime office, OFAC. Arkéa said it also informed its supervisory bodies and is working with judicial and law enforcement authorities to establish the origin of the attack and how it was carried out. France’s national cybersecurity agency ANSSI had not issued any public statement at time of publication.
The incident lands days after the $6.3 billion Binance hack and a run of other financial thefts, including the BTCPay Server hot wallet drains. Unlike those cases, the Arkéa theft started with traditional bank transfers before the money was moved into crypto.
Watch for phishing
Arkéa said customer data has not been reported as compromised, but warned that attacks like this often trigger a wave of phishing attempts. The bank urged customers to never share login details, passwords, card numbers or SMS validation codes, and to contact their adviser directly if they receive a suspicious message claiming to be from the bank.
