Source: AFP / CoinDesk
French regional banking group Credit Mutuel Arkea has confirmed that it was the victim of a cyberattack that allowed fraudulent transactions, with the Paris prosecutor’s office opening an investigation and estimating losses in the order of more than 100 million euros. The bank, headquartered near Brest and part of the wider Credit Mutuel group, said the incident is now contained and that customer accounts were never touched.
What happened
The attackers used the bank’s own account to carry out transactions towards other banking actors, and the money was then converted into cryptocurrency on specialised platforms, the bank said in a statement reported by AFP on 4 November 2026. The attackers came in through the platform of one of the bank’s service providers and reached Credit Mutuel Arkea directly, the bank insisted, rejecting earlier press reports that the entry point was its online subsidiary Fortuneo. Human error has also been excluded, with the bank describing it as a sophisticated attack coming from the outside.
The fraud first came to light through blockchain investigator ZachXBT, who flagged on 2 November that an unnamed EU entity was suspected of losing more than 106 million dollars from accounts at centralised crypto exchanges on 1 November, with stolen funds withdrawn as USDC and USDT. He later identified Credit Mutuel Arkea as the suspected victim and raised his estimate to more than 133 million dollars, saying the true amount could be higher once over the counter trades are included. Crypto.com confirmed it blocked funds linked to the theft and that its customers’ funds were secure.
The response
The bank said its teams mobilised immediately on detecting the attack and temporarily suspended certain transactions as a precaution to prevent further fraudulent movements. Most operations resumed the following morning after security checks and reinforced measures were put in place. The Paris prosecution office’s cybercrime section received the group’s complaint on 4 November and immediately opened an investigation, entrusted to the national anti cybercrime office OFAC. The bank said part of the funds has been blocked and recovery actions are underway, and that the amounts involved do not threaten the group’s financial health. It also warned customers to be alert to phishing attempts that may follow the incident.
Why a supplier platform was the weak spot
The most important detail for any European business is the entry point. Attackers did not break the bank’s core systems head on, they came through a third party service provider’s platform and turned the bank’s own treasury account into their transfer tool. This is the same pattern behind most of the damaging incidents of the past year, from CI/CD pipelines to operational technology suppliers. If your security posture only covers what you run yourself and not what your providers can reach, you are exposed to exactly this kind of attack. Rigorous vendor security assessments, least privilege access for supplier integrations and transaction monitoring that catches unusual out of hours movements are what separate a contained incident from a catastrophe.
If your organisation relies on third party platforms with access to critical accounts, now is the time to review that exposure. Contact the team at Excello Digital for a professional third party risk and security assessment.