Crédit Mutuel Arkéa Confirms Major Cyberattack as Suspected Crypto Theft Reaches $133 Million

The French cooperative bank says attackers used its own account to move funds through other banks, potentially converting them into cryptocurrency. Customer assets remain unaffected, while recovery efforts continue.

French cooperative banking group Crédit Mutuel Arkéa has confirmed that attackers used its own banking account to carry out fraudulent transfers, following reports of a suspected $133 million theft involving cryptocurrency exchanges.

The bank said the attackers accessed its systems through the platform of an external service provider. They then used an Arkéa account to transfer money to other banking institutions. Those transfers may have enabled the attackers to convert the funds into cryptocurrency through specialized platforms.

The confirmation follows blockchain investigator ZachXBT identifying Arkéa as the suspected victim of the incident. He estimated the stolen amount at more than $133 million, based on activity involving centralized cryptocurrency exchanges.

However, Arkéa has not confirmed that exact figure. In a statement on 4 November, it said it could validate the reported order of magnitude but was still assessing the financial impact.

The bank stressed that customer accounts were not used and that the incident had no financial impact on customers. Some funds have been blocked, while further recovery efforts are underway. <Cite refs={[“turn693778search1″,”turn661261search1″,”turn693778search12”]}/>

Attackers exploited a third-party service provider.

Arkéa’s clarification provides a more detailed picture of how the incident unfolded.

The attackers reportedly reached the banking group through the platform of one of its service providers. From there, they accessed the bank directly and used its own account to initiate transactions to other banks.

Arkéa specifically rejected reports that its online banking subsidiary, Fortuneo, was the entry point.

The bank described the incident as a sophisticated external attack and said it was not caused by human error. It has not disclosed the identity of the service provider or the precise technical vulnerability used by the attackers.

This distinction matters because the incident highlights risks that extend beyond a bank’s own technology environment. Financial institutions depend on external providers for critical systems and services. A weakness in one of those connections can create a route into a bank’s operations.

Arkéa said its security systems detected suspicious activity and that its teams activated existing crisis procedures to contain the attack. <Cite refs={[“turn693778search1″,”turn693778search12”]}/>

How the stolen funds moved through cryptocurrency channels

The reported theft attracted attention after ZachXBT began tracking suspicious withdrawals from cryptocurrency exchange accounts.

His investigation identified more than $133 million in suspected withdrawals linked to the incident. Blockchain analytics firm Bitquery separately traced approximately $108.8 million in USDC withdrawals from accounts associated with Kraken, Crypto.com, and OKX during 1 and 2 November.

The funds were reportedly moved through multiple wallets and converted into other digital assets. This activity made recovery more complicated, particularly where funds moved across different blockchain networks or into assets with different freezing capabilities.

Crypto.com and OKX confirmed taking action on accounts or funds linked to the incident, according to reporting by CoinDesk. Crypto.com said it had blocked associated funds. OKX also reported freezing an institutional customer account after identifying unusual activity.

These exchange actions may support recovery efforts, but they do not establish the final amount recovered or the total financial loss. Arkéa has not published a final loss figure or confirmed the complete route taken by the funds. <Cite refs={[“turn661261search1″,”turn661261search3″,”turn693778search12”]}/>

Why the $133 million figure remains unconfirmed

The reported $133 million figure has become central to coverage of the attack. However, Arkéa has deliberately stopped short of confirming it.

The bank said it could validate the order of magnitude but that its teams were still calculating the precise financial consequences. It also confirmed that some funds had been blocked and that other recovery actions were underway.

That distinction is important. The reported amount should not be treated as a final net loss. The ultimate financial impact will depend on the value of funds successfully recovered, the amount permanently lost, and any further findings from the investigation.

Arkéa also said the sums involved would not undermine the group’s financial strength or stability.

The group reported total assets of €211.5 billion and more than 5.8 million members and customers in its November 2026 statement. <Cite refs={[“turn693778search1″,”turn693778search10”]}/>

Customer funds remain protected, but transfers were delayed.

Arkéa said the attackers did not use customer accounts belonging to its banking federations or subsidiaries.

The bank maintained that customer assets were unaffected. However, the incident did cause delays to certain transfers.

As a precaution, the group temporarily suspended some transactions to prevent further fraudulent movements and secure its operations. It also carried out additional checks and introduced enhanced security measures.

By the morning of 4 November, almost all operations had resumed, according to the bank’s subsequent clarification.

The incident therefore appears to have affected the bank’s own funds and operational processes rather than directly exposing customer deposits. Nevertheless, the disruption shows how a cyberattack on internal banking infrastructure can affect payment services even when customer accounts remain untouched. <Cite refs={[“turn693778search1″,”turn693778search2”]}/>

DORA puts third-party technology risks under regulatory scrutiny.

The attack also raises questions about third-party technology risk and operational resilience under the European Union’s Digital Operational Resilience Act (DORA).

DORA establishes requirements for financial institutions to manage information and communication technology risks. It also introduces reporting obligations for major ICT-related incidents.

Under the relevant reporting standards, financial entities must submit an initial notification as soon as possible. The deadline is within four hours of classifying an incident as major and no later than 24 hours after becoming aware of it. Further intermediate and final reports are also required.

The framework places particular emphasis on managing risks associated with external ICT service providers. Banks must maintain oversight of their technology dependencies and ensure that outsourcing does not weaken operational resilience.

Arkéa said it had contacted the relevant regulatory and supervisory authorities. However, the bank has not disclosed how the incident was classified under DORA or provided details of its regulatory reporting timeline. <Cite refs={[“turn693778search0″,”turn693778search6″,”turn693778search1”]}/>

Investigation and recovery efforts continue.

Arkéa said it is working with the relevant judicial and law enforcement authorities to establish the precise origin of the attack and understand how the attackers operated.

The bank has also warned customers to remain alert to possible phishing attempts following the incident. It advised them not to share login details, passwords, card numbers, or SMS verification codes.

The next developments will center on the final financial assessment, the amount of money recovered, and the findings of the investigation into the compromised service provider.

For the wider banking sector, the incident is a reminder that payment security depends on more than protecting customer accounts. Treasury operations, third-party technology platforms, and links between financial institutions can also become targets.

Arkéa has contained the attack and says customer assets remain protected. But the case highlights how a breach in a bank’s operational infrastructure can create a substantial financial loss and expose the complexity of tracing funds across traditional banking networks and cryptocurrency platforms.

Sources: Crédit Mutuel Arkéa statements dated 4 November 2026; ZachXBT investigation; Bitquery findings as reported by CoinDesk; Reuters; EUR-Lex and EU DORA reporting standards.

Crédit Mutuel Arkéa confirms $133m theft, funds laundered via crypto exchanges 

Arkéa cyberattackbanking cybersecurityBitqueryCrédit Mutuel Arkéacrypto theftcryptocurrency exchangesDORAFinancial CrimeFrance fintechoperational resiliencethird-party riskZachXBT