French Bank Credit Mutuel Arkea Confirms Cyberattack

French lender Credit Mutuel Arkea stated on Wednesday that a cyberattack enabled hackers to execute unauthorized transactions directly from the financial institution's own account. On-chain investigator ZachXBT estimates the total theft exceeds $133 million, a specific figure the bank has declined to officially confirm while validating the general order of magnitude.

The Brittany-based financial institution reported in an official statement that the security incident is under control, operations are resuming, and customer assets remain completely unaffected. As a precautionary measure, the bank temporarily suspended certain transaction types. Management emphasized that the event caused only a brief delay in executing specific transfers.

According to a follow-up question-and-answer publication, the perpetrators accessed the network via a third-party service provider to reach the bank directly. Utilizing the institution's own account, the attackers routed funds to external banking partners, which potentially facilitated conversion into cryptocurrency through specialized platforms. The organization clarified that no client accounts across its federations or subsidiaries were compromised, explicitly dismissing local media reports suggesting unauthorized entry occurred through its online banking division, Fortuneo. Officials characterized the breach as an outside cyberattack rather than an internal human error.

Credit Mutuel Arkea confirmed a cyberattack that allowed unauthorized transfers from its account.

While the bank has not released a final monetary figure, provisional estimates reported by AFP placed the incident at approximately 100 million euros. A spokesperson noted that it remains premature to establish a definitive amount. Officials confirmed that a portion of the stolen funds has already been successfully frozen, with recovery procedures underway for the remainder. The institution stressed that the financial impact is minimal and poses no threat to its overall financial health and soundness.

Independent researcher ZachXBT initially reported suspicious activity on Monday without disclosing the victim's identity, noting that an undisclosed European entity lost over $106 million from centralized exchange accounts on November 1. Subsequent updates pushed the estimated total past $133 million before identifying Credit Mutuel Arkea as the affected party. The bank has not validated his timeline or exact figures and is currently collaborating with judicial and police authorities to investigate the breach, having notified regulatory supervisors immediately upon detection. Furthermore, the lender issued warnings regarding potential phishing attempts targeting clients following the incident.

Why it matters

This security breach highlights ongoing vulnerabilities in digital financial infrastructure and third-party vendor integrations within major European banking institutions. While customer assets remain secure and overall financial stability is unaffected, the incident demonstrates how sophisticated external attacks can leverage institutional accounts to route funds into digital asset networks.