Threat watch / Attack
Crédit Mutuel Arkéa: a cyberattack enables fraudulent transfers
The bank confirmed a cyberattack that enabled fraudulent operations and says clients bear no loss. On-chain investigators count more than $100M moved to crypto. The attackers came in through a service provider's platform, not yet named.
- Sector
- Finance
- Way in
- Supplier
- Product or vendor
- None named
- How it happened
- The bank says the attackers came in through "the platform of one of our service providers" and reached Crédit Mutuel Arkéa directly, in "a sophisticated attack from outside" with no human origin. They used the bank's own account ("compte propre") to send transactions to other banks, not client accounts of its federations or subsidiaries. The provider and the method are not named.[6][7] Checked 8 Nov 2026
- What was stolen
- Money moved out by fraudulent transfers, then to crypto exchanges. Investigator ZachXBT estimates at least $133M (about €118M); the bank does not confirm the figure but can "validate the order of magnitude", and says part of the funds was blocked. Bitquery counts $108.8M in USDC.[6][1][3] Checked 8 Nov 2026
- Who was impacted
- Crédit Mutuel Arkéa, which says the incident had "no consequence" on clients' assets, only delayed some transfers. Journalist Grégory Raymond first reported Fortuneo as the channel; the bank denies any entry through Fortuneo. Fortuneo clients were warned of disruption to instant transfers and Wero.[6][2] Checked 8 Nov 2026
- Threat actor
- Not attributed
Timeline
- From 12:25 UTC, $108.8M in USDC is withdrawn from Kraken, Crypto.com and OKX; about 98% is gone by 23:10. Bitquery does not name the victim; IT-Connect ties its figures to Arkéa. [3][1]
- Bitquery's snapshot shows $1.14M frozen by Tether and none by Circle. [3]
- Crédit Mutuel Arkéa confirms a cyberattack that enabled fraudulent operations, says clients face no financial consequence and suspends some transfers. [1][2]
- Grégory Raymond reports the funds left through Fortuneo, to exchange accounts opened with false identities. The bank has not confirmed it. [2][4]
- In an update, the bank says the attackers went through a service provider's platform, that no entry was made through Fortuneo, and that the incident is now contained. [6][7]
- BleepingComputer reports that the bank is working with judicial authorities and the police to establish the origin and method of the attack, and warns clients of a higher risk of phishing. ZachXBT says the attacker may have laundered $30M by November 3; the bank has not commented on that claim. [8]