Crédit Mutuel Arkéa Cyberattack: How Did Funds Reach Crypto? French bank Crédit Mutuel Arkéa says attackers used its own account to send transactions to other banks. The money may then have b
French bank Crédit Mutuel Arkéa says attackers used its own account to send transactions to other banks. The money may then have been converted into cryptocurrency through specialized platforms.
Source: Crédit Mutuel Arkéa Press Release
The Brest-based group shared the details on November 4, 2026 at 5:30 p.m., after its first press release at 1:00 p.m. the same day. The bank calls it a sophisticated attack from outside and says the incident is now under control. The conversion step is what brings this bank hacking incident into the crypto space.
Onchain investigator ZachXBT estimated the losses at more than $133 million. The bank was asked whether 118 million euros, or $133 million, had been stolen. It did not confirm the figure and said it can only validate the order of magnitude.
A final amount is still too early to give, according to the group. Part of the funds concerned has been blocked, and other actions are underway to recover them.
The bank also states that the sums involved cannot undermine the financial strength of Crédit Mutuel Arkéa, which reports total assets of €211.5 billion.
No, according to the group. The attackers did not use accounts held by customers of its federations or subsidiaries. The bank says customer assets were not affected and that the incident only delayed the execution of some transfers.
As a precaution, certain transactions were temporarily suspended. Almost all operations resumed during the morning, once verifications were finished and enhanced security measures were in place. These bank fraudulent transfers therefore sit on the bank's side of the ledger, not its customers'.
Some reports had pointed to Fortuneo, the group's online banking subsidiary. The bank rejects that version. It says there was no entry through Fortuneo.
Instead, the attackers went through the platform of one of its service providers and reached Crédit Mutuel Arkéa directly. The provider has not been named in the statement. The bank also says human error at Arkéa was not the cause.
Under standard procedures, the group contacted the relevant authorities and supervisory bodies. Its teams are now working with judicial and law-enforcement authorities to establish the origin of the attack and its modus operandi, as stated on the official website.
No suspect has been named. The bank has not confirmed any onchain tracing either. Any ZachXBT investigation findings on where the funds moved remain outside the bank's confirmation for now, which matters for a crypto fraud case of this kind.
The first press release mentioned phishing, and journalists asked whether customer data had been compromised.
The group did not say that it was. It explained that attacks of this nature often bring an upsurge in phishing attempts that may try to extort confidential data.
For that reason, it urged customers to stay extremely vigilant. That is a preventive step, not a confirmed data breach.
The data suggests the story is still at an early stage. Four signals will shape it.
First, the final loss figure. The bank validated only the order of magnitude, so the gap between 118 million euros and the final number remains open.
Second, the share of funds blocked or recovered. Third, any official finding on how the service provider's platform was reached. Fourth, whether authorities publish details on the crypto conversion route.
The main uncertainty is how much of the money has already moved beyond recovery. Crypto money laundering cases often depend on how quickly platforms freeze flows, and that detail has not been disclosed.
A wider debate on cryptocurrency security at banks may follow, though that is analysis and not a confirmed development. Updates on this and similar cases appear in the daily crypto news today roundup.
Crédit Mutuel Arkéa has confirmed a cyberattack that used its own account for fraudulent transfers, with a possible conversion into crypto. The bank says customers lost nothing and the situation is contained.
The $133 million crypto theft figure remains unconfirmed, and further verified details will likely come from the authorities and the bank. Broader cryptocurrency news coverage continues to track related security incidents.
YMYL Disclaimer: This article is for information only and is not financial, legal or investment advice. Crypto assets are volatile and carry risk. Details of this incident may change as the investigation continues.
