Crédit Mutuel Arkéa: $133 million via a provider

Crédit Mutuel Arkéa told members on November 4, 2026, that a cyberattack on the French cooperative bank was closed and under control, and that day-to-day operations were returning in stages. The attacker had paid other institutions from an account the bank itself holds. Member balances stayed in place. What customers felt, Arkéa said, was a delay on some transfers. The bank had already taken certain systems offline while it contained the loss.

Arkéa is a major French mutual, with more than 5.8 million members and €211.5 billion in assets, spread across federations and subsidiaries. A payment account at that scale is a rail other banks settle against. The public argument over the size of the theft began two days before the bank spoke.

On November 2, blockchain investigator ZachXBT warned of a large unauthorized pull from centralized-exchange accounts the day before. He put the take at as much as €118 million, about $133 million, withdrawn as USDC and USDT, and he left the victim unnamed. By November 3, on his account, about $30 million had already been laundered, in a window where a named victim would have given EU law enforcement something to freeze. Arkéa’s FAQ accepts the order of magnitude and declines the exact figure. The bank calls the sum significant and says some of the funds were blocked.

The path was a provider, then the bank’s own account

Arkéa says the attacker entered through a service provider’s platform. The bank has cleared its Fortuneo subsidiary of being that route. Once inside, the attacker transacted with other banking organizations from Arkéa’s own account and converted funds into cryptocurrency. Arkéa has set staff error aside and described the intrusion as a sophisticated attack. Judicial authorities and the police are working with the bank on origin and method. BleepingComputer asked Arkéa for more and had no reply when its report ran.

The member notice is narrower than the investigator’s. Client assets, across the federations and the subsidiaries, are intact. Some transfer orders ran late. The systems the bank suspended are the containment. Counterparties that received those payments are inside the incident. The loss, on the bank’s telling, sits on Arkéa’s account.

What members, counterparties, and providers do now

Members should treat the delay as a timing problem and the follow-on fraud as the live risk. Arkéa has asked customers to hang up on unsolicited calls, to keep codes and personal details out of inbound mail, and to check any odd message by phoning the adviser already on file. A note that offers to release a stuck transfer is the lure this outage invites.

Banks that took funds from Arkéa around November 1 should reconcile those payments with Arkéa and hold anything that still matches the diverted flow. Exchanges that booked large USDC or USDT deposits in the same window should keep the records and honor a freeze from law enforcement. ZachXBT’s timeline says a slice of the money was moving before the bank’s November 4 notice. The slice Arkéa says was blocked is the part still worth a hold.

A firm that runs a platform a bank uses to reach its own payment accounts should treat that identity as a privileged path. List which vendor accounts can start a transfer of the institution’s funds. Require a second channel before a new beneficiary or a conversion into crypto. Keep the logs a police inquiry will ask for. Arkéa has not named the provider. Fortuneo is the name it has cleared. Until the bank publishes the rest, the control is that access.

This briefing relies on public reporting by BleepingComputer, on ZachXBT’s public account, and on Crédit Mutuel Arkéa’s statements.