Hackers Steal Up to $133 Million From French Bank Crédit Mutuel Arkéa via Service Provider Breach

French cooperative bank Crédit Mutuel Arkéa was hit by a cyberattack that enabled fraudulent transactions of up to $133 million, with the attacker gaining access through a third-party service provider's platform and converting stolen funds into cryptocurrency.

The incident, first reported by BleepingComputer, marks one of the largest publicly disclosed cyber-enabled bank thefts in recent European history. Arkéa is a major French banking group serving more than 5.8 million members and holding 211.5 billion euros in assets.

Public awareness of the attack emerged on November 2, when blockchain fraud investigator ZachXBT warned of large-scale unauthorized withdrawals from multiple centralized exchange accounts occurring the day prior. The investigator estimated the attacker may have stolen up to 118 million euros — approximately $133 million — withdrawing the funds as USDC and USDT stablecoins.

ZachXBT did not initially name the institution, and the lack of an early public disclosure allowed the attacker to launder an estimated $30 million by November 3, funds that EU law enforcement would otherwise have been positioned to freeze.

Arkéa formally disclosed the incident on November 4, stating the situation "is now closed and under control" and that operations were gradually returning to normal.

"Crédit Mutuel Arkéa wishes to reassure all its clients — across its federations and subsidiaries — that this incident has no impact on their assets; it has merely resulted in a delay in the execution of certain transfer transactions," the bank said in a machine-translated statement.

In a separate FAQ, the bank clarified that the attacker entered its network through a service provider's platform — ruling out its Fortuneo subsidiary — and then used Arkéa's own institutional account, not individual customer accounts, to transact with other banking institutions and convert funds into cryptocurrency.

The bank stopped short of confirming the full dollar figure attributed to the breach. When asked directly whether 118 million euros were stolen, the bank responded: "We do not confirm this information and can only validate the order of magnitude."

Arkéa ruled out human error at the institution and characterized the incident as a "sophisticated attack." The bank said it is working with judicial authorities and law enforcement to establish the precise origin and methods used by the attacker.

Customers were also warned of elevated phishing risk in the attack's aftermath, with the bank urging them to remain vigilant against unsolicited communications and to verify any suspicious messages by contacting their bank adviser directly.

The breach underscores the persistent vulnerability that third-party service providers represent for financial institutions — a vector that regulators across the EU have flagged as a systemic risk under frameworks including the Digital Operational Resilience Act, which came into full force in January 2025. With stolen funds already partially laundered before disclosure, the timeline of the incident is likely to draw scrutiny from regulators examining whether notification obligations were met in a timely manner.

Disclaimer