Crédit Mutuel Arkéa Cyberattack Moves Reported €100 Million Out of French Bank and Into Crypto Exchanges

On Wednesday, November 4, 2026, the French cooperative banking group Crédit Mutuel Arkéa confirmed that criminals had used a cyberattack to push fraudulent transactions through its systems and move money out of the bank’s own accounts. The bank said the incident was under control, that its customers would suffer no financial consequences, and that it had alerted the authorities. What it did not say was how much had been taken, and in the hours that followed, the gap between the bank’s careful silence and the public blockchain trail filled with figures ranging from about €100 million to more than $133 million.

The case is unusual in several ways. The money is reported to have come from the bank’s own capital rather than from customer accounts, the alarm was first raised not by the bank but by an independent blockchain investigator, and part of the trail runs through some of the world’s largest cryptocurrency exchanges. This is the story of the Crédit Mutuel Arkéa cyberattack of November 2026, the reported €100 million loss, and the questions the bank has still not answered.

1. What the bank confirmed on November 4

The confirmation arrived on Wednesday, November 4, 2026, when a spokesperson for Crédit Mutuel Arkéa told Bloomberg News that the group had been the victim of a cyberattack that enabled fraudulent transactions. In its own statement, the bank said the attackers had used its own account to send transactions to other banks, that some transactions had been suspended as a precautionary measure, and that the situation was under control. It declined to say how much money had been taken or how the attackers had got in.

1.1 The statement in the bank’s own words

The bank’s public language was deliberately narrow. It confirmed the attack, confirmed that fraudulent transfers had taken place, and confirmed that it had contacted the authorities. It drew a firm line between its own accounts and those of its customers, saying the attack had hit the bank’s own capital and that customer accounts were not financially affected. A spokesperson told the French magazine Capital, in words the bank clearly wanted its customers to hear: “We want to reassure all our customers: this incident has no financial impact on them.”

1.2 What “under control” means for customers

For customers, Wednesday morning was still disruptive. The bank’s app displayed an error message when users tried to log in, and some transfers could not be made while the bank secured its operations. The disruption was the visible side of the precautionary suspensions the bank had ordered as soon as it discovered the attack. The reassurance and the disruption sat side by side: the bank insisted no customer would lose money, while its own systems were visibly struggling, and the distinction between the bank’s money and the customers’ money became the most important fact in the story.

2. How the money moved

According to the reporting that followed the bank’s confirmation, the attackers did not break into customer accounts one by one. Instead, they reached the bank’s own funds and moved them outward in large transfers, then pushed the money through cryptocurrency platforms where it could be split, swapped and scattered. The route matters because it explains both the size of the loss and the speed with which it was spotted by people outside the bank.

2.1 From the bank’s own account to other banks

Arkéa said the attackers reached the bank through the platform of an unnamed service provider. One report, citing financial industry officials, said the attackers had hacked the computer of a third party with transaction authority and used that access to reach the bank’s own capital, of which the bank is reported to hold about €10 billion. Several French outlets, citing anonymous sources, reported that the fraudulent transfers were made from Fortuneo, the group’s online bank, to accounts opened under false identities on cryptocurrency platforms.

2.2 The crypto conversion trail

Once the money left the bank, it moved fast. Blockchain analytics firm Bitquery traced about $108.8 million in USDC stablecoins withdrawn from accounts at Kraken, Crypto.com and OKX over about 21 hours on November 1 and 2, with about $63 million swapped into 27,553 ether in about four hours through the decentralised exchange UniswapX. The bank said part of the funds had been blocked and that other recovery efforts were under way, but the final loss will depend on how much is frozen or recovered, which is not yet known.

3. The numbers that do not agree

Three different figures now circulate for the same theft, and they do not measure the same thing. The bank has confirmed none of them, which is why the reporting keeps attaching a different number to a different source. Understanding where each figure comes from is the only way to read the story honestly.

3.1 ZachXBT’s tracing: $106 million to $133 million

The first public alarm came from ZachXBT, an independent investigator who specialises in tracing cryptocurrency transactions. On November 2, he reported suspicious withdrawals totalling more than $106 million tied at first to an unnamed European institution, and later raised his estimate to more than $133 million, or around €118 million, and named Arkéa. His two numbers are one running tally, not two competing claims: the first estimate plus the $27 million he added after tracing more withdrawals equals the $133 million figure. He also said he was highly confident that North Korea’s Lazarus Group was not behind the theft.

3.2 The bank’s provisional €100 million figure

Arkéa itself has declined to confirm any sum. A spokesperson told Reuters the losses were lower than ZachXBT’s estimate and that it was still too early to give a final amount, while AFP reported that the bank put its provisional estimate at about €100 million, or about $112 million. Separately, the bank is reported to have said the reported order of magnitude was valid without confirming the exact figure. For scale, Arkéa earned a net profit of €230 million in the first half of the year, so a gross loss near €118 million would equal roughly half that result, although the bank said the amount was not such as to undermine its financial health.

4. How the alarm was raised

One of the strangest features of this case is the order in which the world learned about it. The blockchain told the story first, the exchanges reacted second, and the bank confirmed it third. That sequence has shaped everything about how the theft is understood.

4.1 ZachXBT’s November 2 flag

ZachXBT first flagged the suspicious withdrawals on Monday, November 2, two days before the bank’s public confirmation. At that stage he did not name the victim, describing it only as an unnamed European entity that had lost more than $106 million through centralised exchanges on November 1. The flag was built from on-chain tracing: large, unusual withdrawals visible to anyone watching the public ledger. By the time the bank spoke, the investigator’s tally had already grown and the victim’s name was public.

4.2 Kraken’s alert and the blocked transfers

The exchanges were also ahead of the bank. Kraken, the United States cryptocurrency exchange, spotted an abnormally large transfer from a European bank, issued an alert on November 3 and blocked the transactions that were still in progress. That intervention is one reason part of the funds could be frozen at all. It also underlines a new reality for bank theft: when stolen money moves through crypto exchanges, the exchanges themselves can become the first line of defence, and their alerts can arrive before the victim’s own public statement.

5. Who Arkéa is — and who is not affected

Confusion about who was hit spread almost as fast as the news itself, because the Crédit Mutuel name covers more than one banking group in France. Getting the boundaries right matters for millions of customers who need to know whether they are affected.

5.1 Brittany, Fortuneo and Keytrade

Crédit Mutuel Arkéa is headquartered in Le Relecq-Kerhuon, near Brest in Brittany. It includes the Crédit Mutuel de Bretagne and Crédit Mutuel du Sud-Ouest federations, along with several subsidiaries, including Fortuneo, the group’s online bank, from which the fraudulent transfers were reported to have been made. The group is also the parent of Keytrade Bank in Belgium, which is why Belgian media covered the attack closely and why Belgian customers asked the same questions as French ones.

5.2 The other Crédit Mutuel groups

Arkéa should not be confused with the rest of Crédit Mutuel and CIC, which belong to a different group. Their customers are not affected by this incident at this stage, according to the bank’s statements. That distinction was repeated in French coverage precisely because the shared name makes confusion easy. The affected group is the Brittany-based one, and the reassurance about customers applies to its customers, including those of Fortuneo and Keytrade.

6. The investigation now under way

Within a day of the confirmation, the case had moved from a bank’s internal incident to a criminal investigation with prosecutors, a cybercrime unit and an international money trail. What happens next depends on how much of the money can be found and frozen before it disappears further into the crypto system.

6.1 Paris prosecutors open a case

The Paris public prosecutor’s office told AFP it had opened an official investigation after Arkéa filed a complaint with its cybercrime section. The investigation is aimed at identifying those responsible and tracing where the money went. No arrests have been reported, and no suspect has been named in the reporting so far. The involvement of the Paris prosecutors, rather than only local police in Brittany, reflects the scale of the sums involved and the cross-border nature of the crypto trail.

6.2 What recovery looks like so far

Recovery is under way but incomplete. The bank said part of the funds had been blocked, and Kraken’s intervention stopped some transfers while they were still in progress. The Bitquery tracing shows how much moved in the first day, and how quickly a large share was swapped into ether, which is harder to freeze than funds sitting on a centralised exchange. Until the bank or the prosecutors publish a recovered total, the real loss remains the gap between the reported figures and whatever is eventually clawed back.

7. Why this attack worries French banking

A theft of this size from a regional banking group raises questions that go beyond one bank’s bad week. It touches how banks guard their own capital, how much they depend on outside service providers, and whether the crypto off-ramp has become the standard exit route for bank thieves.

7.1 A bank’s own capital, not customer accounts

Most bank fraud stories are about customer accounts being emptied a little at a time. This one is different: the attackers are reported to have reached the bank’s own capital, pulling more than €100 million out of roughly €10 billion the bank held. That is a failure of institutional controls, not of individual account security, and it raises uncomfortable questions about who held transaction authority, how a third-party platform could become the entry point, and how such large transfers could leave the bank before anyone inside stopped them.

7.2 The Binance parallel

The intrusion method is reported to closely resemble the hack suffered by the cryptocurrency exchange Binance, which recently lost a total of $6.34 billion in digital assets to a cyberattack. The parallel is not proof of a link, and ZachXBT has said he does not believe North Korea was behind the Arkéa theft, but the resemblance has fuelled concern across France’s financial sector that the same techniques are now being turned on traditional banks. A method that worked against the world’s largest crypto exchange, applied to a regional bank, is a warning that no institution is too small or too traditional to be a target.

8. What remains unconfirmed and what to watch next

Much of this story is still attributed rather than established. The bank has confirmed the attack and the fraudulent transactions, but the most important details are either unconfirmed or actively disputed between the bank and the investigators who traced the money.

8.1 The open questions

The exact amount stolen remains unconfirmed, with the bank’s provisional figure of about €100 million sitting below ZachXBT’s traced figure of more than $133 million. The precise method of the attack is undisclosed, including how the third-party platform was breached and which systems the attackers touched. Who is behind the attack is unknown, no arrests have been reported, and it is not confirmed whether any customer data was accessed or whether any other banks were probed in the same way. The full extent of the blocked and recovered funds is also still unknown.

8.2 What to watch next

Watch for the bank’s next statement and any confirmed figure it is willing to publish, since that number will settle the argument between the €100 million and $133 million estimates. Watch for updates from the Paris prosecutors on suspects, arrests and recovered funds, and for any regulatory response from French banking supervisors about third-party platform access. Watch too for whether Fortuneo and Keytrade report any further service disruption, and whether other European banks disclose similar attempts, which would show whether Arkéa was a one-off target or the first visible case of a wider campaign.

The Crédit Mutuel Arkéa cyberattack is confirmed as an event and contested as a number. What is not in doubt is that criminals moved a very large sum out of a French bank’s own accounts, through other banks and into cryptocurrency exchanges, in the space of about two days, and that the world learned about it from a blockchain investigator before it heard it from the bank. Until the bank confirms a figure, the prosecutors name a suspect, or the recovery total is published, the reported €100 million loss, the $133 million tracing claim, the method of entry and the identity of the attackers all remain as reported and unconfirmed, and the final cost of the attack is still unknown.

Comments

comments