Crédit Mutuel Arkéa Loses More Than €100 Million After Attackers Enter Through a Service Provider: What the French Bank Heist Teaches Every Finance Team

A week after the record Binance theft, a mainstream European bank has disclosed a heist of its own. Crédit Mutuel Arkéa, the Brittany-based cooperative banking group with 5.8 million members and customers and 211.5 billion euros in assets, confirmed on Wednesday 4 November 2026 that it had been the victim of an attack that "enabled fraudulent transactions". By that evening it had put a provisional figure on the loss: about 100 million euros.

What makes the case instructive is not the size of the loss, which the bank says does not threaten its financial strength, but the route. By Arkéa's own account, the attackers did not break into customer accounts or steal a cryptocurrency wallet. They came in through the platform of a service provider, used the bank's own account to send transfers to other institutions, and moved the money into cryptocurrency before all of it could be stopped. The bank's statements are in French; the quotations here are our translations.

What Happened

The first public sign came from outside the bank. On 2 November the independent blockchain investigator known as ZachXBT reported a suspected theft of more than 100 million US dollars from an unnamed European entity, and late on 3 November he named Crédit Mutuel Arkéa as the likely victim, according to a timeline compiled by the security firm Halborn. His estimate later rose to more than 133 million dollars.

Arkéa published its first statement on 4 November. It said it had informed the relevant regulatory and supervisory authorities as soon as the attack was detected, had temporarily suspended certain transactions "to secure operations and prevent further fraudulent movements", and that the incident was "closed and under control". Later the same day it published a set of questions and answers that added the key details. The attackers "used Crédit Mutuel Arkéa's own account to make transactions to other banking players", which potentially allowed them to convert the money into cryptocurrency through specialised platforms. They did not go through its online bank Fortuneo, as some press reports had said. Instead, "the attackers went through the platform of one of our service providers and thereby reached Crédit Mutuel Arkéa directly." Asked whether human error was to blame, the bank answered no: "It was a sophisticated attack from outside, which is now contained."

AFP reported that evening that the bank had filed a complaint that morning, that the cybercrime section of the Paris public prosecutor's office had opened an investigation into attacks on an automated data processing system by an organised group, and that the case had been assigned to OFAC, France's anti-cybercrime office. The bank declined to confirm the figure of 118 million euros reported by Le Télégramme but said the order of magnitude was right, and that part of the funds had already been blocked.

On 6 November Daniel Baal, president of the Confédération Nationale du Crédit Mutuel, told France 5 that Arkéa had recovered "part" of the more than 100 million euros, without saying how much. He could not say whether the attack was carried out from France or abroad, and said the episode "should serve as a lesson" for the whole banking sector.

What the Blockchain Record Suggests

The bank has said little about the mechanics, so much of the detail comes from on-chain tracing, and it should be read as analysts' reconstruction rather than confirmed fact. Halborn's summary, citing ZachXBT and the French journalist Grégory Raymond, describes transfers from the bank's own account to accounts at centralised cryptocurrency exchanges that had been opened under false identities. The money was converted into the US dollar stablecoin USDC and withdrawn to external wallets over roughly 21 hours on 1 and 2 November, beginning at 12:25 UTC on the Sunday. Several wallets received a test payment of 1,000 dollars followed a minute later by the full balance, typically five to ten million dollars. The funds were then swapped into Ether, moved across several blockchains, passed through instant exchange services and in part converted into Monero.

One detail stands out. According to Halborn, eleven of the fifteen receiving wallets had been taking payouts from the same exchanges since May. Analysts first assumed they were the bank's own approved addresses; later French reporting indicates they belonged to the fraud network, which would mean the cash-out infrastructure had been in place for months. ZachXBT has also argued that stablecoin issuers and exchanges acted slowly, with only around 1.1 million dollars frozen by one issuer and exchange accounts restricted only after his public alert. Those are his claims, and the companies concerned have not been quoted in the reports we reviewed.

Who Is Affected

Arkéa is clear that its customers are not out of pocket. No customer accounts in its regional federations or subsidiaries were used, no customer data theft has been reported, and the only practical effect was a delay to some transfers while operations were suspended. Almost all operations resumed on the morning of 4 November. The loss falls on the bank itself.

The bank has nonetheless warned customers to expect phishing. High-profile incidents are routinely followed by messages claiming to come from the affected bank, and Arkéa has reminded customers never to share login details, card numbers or SMS validation codes and to contact their adviser directly if in doubt.

The unnamed service provider is the other affected party. Nothing has been published about which provider it is, what its platform does or how it was compromised, and it would be wrong to speculate. What is known is that access granted to a supplier was enough to reach a function that could move the bank's own money.

Why It Matters

For most organisations, payment fraud means an invoice scam or a compromised mailbox. This was different in kind. The attackers reached a position from which they could issue transfers from an institution's own operating account, and they had mule accounts at regulated exchanges ready to receive them. Three aspects deserve attention outside banking.

The first is that third-party access is part of your payment perimeter. Every organisation has supplier platforms connected to the systems that move money: payroll bureaux, treasury and cash management tools, accounts payable automation, payment service providers and the integrations between them. The question Arkéa's investigators will be asking is the one every finance director should ask: what can that external access actually do, and which independent control would stop it if the supplier were compromised? For EU financial entities this is also a regulatory question, since the Digital Operational Resilience Act requires them to manage ICT third-party risk across the life of each service.

The second is timing. The reconstructed withdrawals began on Sunday 1 November, which is also a public holiday in France. Attackers choose weekends and holidays because approval chains are thin and monitoring teams are smaller. Controls that depend on someone noticing on Monday morning are not controls.

The third is speed of recovery. Stablecoins can be frozen by their issuers and exchange accounts can be restricted, but only if the right people are told before the funds are swapped onwards. In this case the world learned of the theft from a blockchain investigator two days before the bank's statement. Whatever was happening behind the scenes, the lesson for everyone else is that recovery depends on contacts and procedures prepared in advance, not on good fortune.

What To Do Now

List every supplier that can initiate, approve or alter payments. Include platforms that connect to your bank through an API or host-to-host link, not only people with online banking logins. For each one, record what it can do, on which accounts and up to what value.

Put independent limits on your own accounts. Set transaction and daily limits at the bank, not only in the supplier's platform. Require a second approval through a separate channel for high-value transfers, new beneficiaries and transfers to cryptocurrency exchanges or payment institutions you have never paid before.

Monitor for behaviour, including out of hours. A run of large transfers to new beneficiaries on a Sunday should raise an alert whether or not each transfer is individually valid. Make sure someone is on call to act on it.

Be able to cut a supplier off quickly. Know who can disable a provider's access, revoke its credentials and certificates and suspend the affected payment channel, and how long that takes. Test it.

Prepare the recovery calls. Agree in advance how you would ask your bank to recall payments, who would contact receiving banks and exchanges with a freeze request, and how you would reach law enforcement. In the UK that means your bank's fraud team, the police through the national fraud reporting service and, for regulated firms, the FCA. Minutes matter more than paperwork.

Review supplier contracts and assurance. Ask providers with payment access how they protect and monitor their own platform, how quickly they must tell you about a compromise and whether you can test the connection. Our guide to evidence-based vendor assessment covers how to go beyond a questionnaire.

Warn staff and customers about follow-on phishing. Incidents like this are quickly used as a pretext for fake security messages.

How Cybergen Can Help

Cybergen's third-party and supply chain risk management service helps organisations identify which suppliers hold access that matters and test the controls around it. Our 24/7/365 managed detection and response provides monitoring that does not stop at weekends, and our incident response service can help you prepare and rehearse the first hours of a payment fraud.

Frequently Asked Questions