TLDR
- Crédit Mutuel Arkéa says attackers entered through a third-party service provider’s platform, not through its Fortuneo unit.
- The bank confirmed only the “order of magnitude” of the reported €118 million ($133 million) loss.
- Customer assets were not affected, but some transfers were delayed.
- The Paris public prosecutor has opened an investigation into an organized group.
- ZachXBT traced funds through exchanges and Monero, and said he doubts Lazarus Group was involved.
Crédit Mutuel Arkéa said on November 4 that hackers used its own account to make fraudulent transfers. The French bank has not confirmed the exact amount lost. It did say the reported figure of €118 million ($133 million) is in the right range.
French Bank Crédit Mutuel Arkéa Details $133M Cyberattack via Third-Party Provider, Funds May Have Been Converted Into Crypto
French banking group Crédit Mutuel Arkéa disclosed further details on November 4 about a cyberattack reportedly involving approximately $133 million.… pic.twitter.com/eTJXd5fb5p
— Wu Blockchain (@WuBlockchain) November 5, 2026
The bank said attackers first entered the platform of an outside service provider. From there, they reached the banking group directly. It has not named the provider or explained what weakness let them in.
How the attackers got in
The bank rejected reports that the breach came through Fortuneo, its online banking subsidiary. It described the incident as a “sophisticated attack from outside.” It also denied that an employee’s mistake caused it.
The money moved out of an account that belongs to Crédit Mutuel Arkéa itself. It did not come from accounts held by customers. The bank said transfers were sent to other financial institutions.
Staff turned on emergency measures once the activity was spotted. Some banking transactions were paused while the group checked its systems. The bank also strengthened its security controls.
Services began to resume on November 4. A later update said almost all operations were back that morning after extra checks. Some customers saw delays in transfers.
The bank said part of the affected money has been blocked. It did not say which institutions hold those funds or how much was secured. Efforts to recover the rest are continuing.
The bank said the amounts involved cannot harm its financial strength. It lists total assets of €211.5 billion ($238.1 billion). It has more than 12,000 employees and over 5.8 million members and customers.
What blockchain tracking showed
Onchain investigator ZachXBT first flagged the exploit on November 2. He estimated losses above $133 million. He said the total could rise because the attack ran for several days and may have included over-the-counter trades.
He described withdrawals through centralized exchanges. Funds were then swapped between USDC, USDT and Ethereum. Some went through instant exchanges, including WellWallet and Kyrrex.
He said other funds were converted into Monero through Wagyu and bridged across several blockchains. He claimed more than $30 million had already been laundered. He also said he has a “high degree of confidence” the attacker is not tied to North Korea’s Lazarus Group.
The bank said the stolen money may have been turned into crypto after it reached other institutions. It did not confirm that any crypto purchases took place. It also did not name any trading platforms, tokens or wallet addresses.
The bank has not confirmed that every transaction ZachXBT identified is linked to its systems. It has not said whether investigators know where the missing money ended up.
The bank warned customers that criminals could use the incident for phishing. It told clients never to share banking passwords, account identifiers, card numbers or SMS codes. Customers who get odd messages should contact their banking advisers directly.
The bank did not say any customer data was compromised. It reported no confirmed theft of customer information.
The bank told supervisory and law enforcement authorities after it found the attack. AFP reported that the Paris public prosecutor’s office opened an investigation into an alleged attack on an automated data-processing system by an organized group. The bank said its security teams are working with judicial and police authorities to find the origin of the attack and the methods used.
