By French banking group Crédit Mutuel Arkéa has confirmed a sophisticated cyberattack involving fraudulent transfers from its own accounts, following reports that hackers stole approximately $133 million and potentially converted the proceeds into cryptocurrency.
In a November 4 statement, the Brittany-based lender said attackers gained access through the platform of an external service provider before initiating transfers to other financial institutions.
Those transfers may subsequently have enabled the conversion of funds into cryptocurrency through specialized trading platforms. The bank declined to confirm the reported €118 million ($133 million) loss, acknowledging only the approximate scale of the incident.
It emphasized that the final financial impact remains under investigation because some funds have already been blocked and additional recovery efforts are underway. Crédit Mutuel Arkéa also confirmed that customer accounts were not used and that clients would not suffer financial losses.
Third-Party Compromise Enabled Fraudulent Bank Transfers
According to the bank, attackers accessed its infrastructure through an unidentified service provider rather than directly compromising customer accounts. The institution rejected reports suggesting that Fortuneo, its online banking subsidiary, served as the entry point.
Arkéa characterized the incident as an external cyberattack rather than an internal operational error. Following detection, the bank temporarily suspended certain transfers while implementing additional security controls. Most affected operations resumed on November 4 after the institution completed its initial security checks.
The bank said the incident had been contained and would not threaten its financial stability. French authorities have opened a criminal investigation into the suspected intrusion. The Paris public prosecutor’s office confirmed that investigators are examining allegations involving an organized attack against an automated data-processing system.
The institution has not identified the attackers or disclosed the specific vulnerability exploited through its service provider. It is cooperating with judicial authorities and financial regulators to determine the circumstances surrounding the breach.
Blockchain Investigators Trace Suspected Cryptocurrency Laundering
The incident attracted attention after independent blockchain investigator ZachXBT identified Crédit Mutuel Arkéa as the suspected victim of a major cryptocurrency-related theft. ZachXBT initially estimated suspicious transactions exceeding $106 million before identifying additional activity that raised the reported total above $133 million.
Blockchain analytics company Bitquery separately traced approximately $108.8 million in USDC withdrawals associated with accounts at Kraken, Crypto.com and OKX between November 1 and November 2. The funds reportedly moved through multiple blockchain addresses, with portions converted into ether.
However, Bitquery acknowledged that blockchain transaction records alone cannot establish a definitive connection between those withdrawals and Arkéa’s banking accounts. Consequently, the cryptocurrency movements should not be treated as independently verified evidence of the bank’s total losses.
Crypto.com confirmed that it had blocked funds associated with the suspected incident, while OKX reported freezing an institutional account after identifying unusual activity. Both exchanges indicated that other customer accounts remained unaffected.
The case highlights the risks created when compromised traditional banking infrastructure intersects with cryptocurrency exchanges and blockchain-based asset transfers. Although blockchain transactions can be traced publicly, recovering assets becomes more complicated when funds pass through multiple platforms and are converted into cryptocurrencies without centralized freezing mechanisms.
For Crédit Mutuel Arkéa, the immediate priorities remain identifying the attackers, establishing the final loss and recovering outstanding funds. The incident also underscores the importance of third-party cybersecurity oversight as financial institutions expand their exposure to digital asset infrastructure.