French Bank Credit Mutuel Arkea Says Cyberattack Drove Fraudulent Transfers From Its Own Account

Credit Mutuel Arkea said on Wednesday, November 4, that a cyberattack allowed hackers to carry out fraudulent transfers from the bank's own account. The bank said the incident was under control, that operations were resuming and that customer assets were not affected.

In its public statement, the bank said: "Credit Mutuel Arkea has been the target of an attack that enabled the execution of fraudulent transactions. The incident is now under control." The bank called the incident "a sophisticated attack from the outside."

How the attackers got in

In a question and answer note, Arkea said the attackers went through the platform of one of its service providers and reached the bank directly. The attackers used the bank's own account to send transactions to other banks, which then potentially allowed them to convert the money into cryptocurrency through specialized platforms.

The bank denied French press reports that the attackers got in through Fortuneo, its online banking arm. It also said the attack was not the result of human error.

What customers felt on Wednesday

The bank app was inaccessible and some transfers could not be made on Wednesday, November 4. The bank suspended certain transactions as a precaution after discovering the attack. By the time of its statement, the bank said operations were resuming.

The money, and what is not confirmed

The bank has not given a final figure. Asked whether 118 million euros, or 133 million dollars, had been stolen, it said it does not confirm the number and can only validate the order of magnitude. A spokesperson told Reuters: "It is still too early to give a final figure."

AFP reported that the bank put the attack at about 100 million euros in a provisional estimate. Reuters reported that the bank said its losses were lower than the 133 million dollar figure put forward by on-chain investigator ZachXBT. Readers should treat the 100 million euro figure as a provisional estimate and the 133 million dollar figure as the investigator estimate, not as a confirmed final loss.

Part of the funds involved has been frozen and other steps are underway to recover the rest, the bank said. It added that the amounts at stake are not large enough to threaten its financial health or soundness.

The trail flagged before the bank spoke

ZachXBT first flagged the incident on Monday, November 2, without naming the victim. He wrote on his Telegram channel that an EU entity was suspected of losing more than 106 million dollars from multiple centralized exchange accounts on November 1, with the funds withdrawn as USDC and USDT. He later raised the total to more than 133 million dollars.

On-chain analytics firm Bitquery traced 108.8 million dollars in USDC withdrawn from Kraken, Crypto.com and OKX on November 1 and 2.

Investigation and the bank

Paris prosecutors opened an investigation on Wednesday after Arkea filed a complaint with their cybercrime section, and the France Anti-Cybercrime Office is handling the case.

Arkea is headquartered in Le Relecq-Kerhuon, near Brest in northwest France. It had some 5.6 million customers at the end of 2025 and is part of the wider Credit Mutuel group, grouping the Credit Mutuel federations of Brittany and the Southwest.