The short version
Attackers stole a reported €118 million ($133 million) from Crédit Mutuel Arkéa by entering through a service provider’s platform and wiring money out of the bank’s own account. The French cooperative bank, with about 5.8 million members, confirmed the attack on November 4, 2026 and says customer assets were not affected. For fintech and banking platforms, the case shows that a vendor with a path to payment initiation is part of your attack surface, not just part of your supply chain.
What happened at Crédit Mutuel Arkéa?
Crédit Mutuel Arkéa, the Brittany-based group behind Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest and the online bank Fortuneo, said on the evening of November 4, 2026 that it had been hit by a “sophisticated attack from the outside”. In a follow-up statement, the bank said the attackers “passed through the platform of one of our service providers” and reached the bank directly. They then used Crédit Mutuel Arkéa’s own account to send transfers to other banks, which potentially let them convert the money into cryptocurrency.
The bank has not named the provider or explained how the attackers moved from that platform into its systems. It says the attack has been contained, that it is working with judicial and police authorities, and that part of the money has been blocked. It also rejected reports that internal human error was to blame, according to The Record and BleepingComputer.
| Date (2026) | Event |
|---|---|
| November 1–2 | ZachXBT flags an unnamed EU institution losing more than $106 million through centralized exchange accounts |
| November 3 | A further $27 million in exchange withdrawals by the same actor, taking the total to about $133 million |
| November 4 | Crédit Mutuel Arkéa confirms the attack; some transfers are delayed while operations are paused |
| November 5–9 | The bank names a service provider’s platform as the entry point, rules out Fortuneo and reports part of the funds frozen |
How did the money leave the bank?
The fraud used the bank’s own funds rather than customer balances. Transfers went from Arkéa’s account to accounts at other institutions, and from there to cryptocurrency exchanges. ZachXBT tracked the withdrawals as USDC and USDT stablecoins; Help Net Security, citing blockchain analysis, reports that part of the proceeds was swapped into ether and some into Monero, which is much harder to trace. ZachXBT said laundering patterns did not point to North Korea’s Lazarus Group.
French journalist Grégory Raymond reported, citing sources, that the receiving exchange accounts were opened with falsified identities whose names matched the transfer details. If confirmed, that would explain why payee-name checks did not stop the money: a name check confirms that the name and account match, not that the account holder is legitimate. The bank has not commented on this point.
What it means for US & EU software teams
The core lesson is about reach. Most third-party risk reviews ask whether a vendor holds sensitive data. The more important question for payment systems is whether a vendor’s platform can initiate or approve money movement, and from which accounts. Here, the attackers did not need customer credentials at all; a path from a provider’s platform to the bank’s own account was enough. Treasury, settlement and operational accounts often have higher limits and fewer behavioral checks than retail accounts, which makes them an attractive target.
For EU banks, payment institutions and their software suppliers, this sits squarely under the Digital Operational Resilience Act, which has applied since January 17, 2025. DORA expects a register of ICT third-party providers, contracts with audit, termination and exit rights, and staged reporting of major ICT incidents. For US firms, the 2023 interagency guidance on third-party relationships from the Federal Reserve, FDIC and OCC sets similar expectations across the vendor life cycle. In both markets, auditors will ask the same question after this case: which vendors can move money, and what stops them if they are compromised?
The laundering route matters too. Funds reached exchanges within hours and were converted to stablecoins and then to assets that issuers cannot freeze. Detection measured in days is too slow for that. Controls have to act before or at the moment a transfer leaves the institution.
What should payment and banking teams check now?
- Map vendor reach to money. List every third-party platform that can create, release or approve a payment, and from which accounts, including internal treasury and settlement accounts.
- Separate read from initiate. Give vendor integrations the narrowest scope possible, with short-lived credentials, mutual TLS or signed requests, and no standing rights to release payments.
- Add limits to the bank’s own accounts. Apply velocity limits, new-beneficiary holds and out-of-band dual approval to large outgoing transfers from institutional accounts, not just customer accounts.
- Watch for exchange-bound flows. Flag bursts of transfers to new counterparties and accounts linked to crypto on-ramps, and route them to manual review.
- Build a vendor kill switch. Make sure you can suspend one provider’s connection in minutes without stopping all payments, and rehearse it.
- Test incident reporting. Run a tabletop on a vendor-originated fraud scenario against your DORA or regulator reporting timelines.
Frequently asked questions
What happened at Crédit Mutuel Arkéa?
On November 4, 2026, Crédit Mutuel Arkéa confirmed a cyberattack that allowed fraudulent operations. The bank says attackers passed through the platform of one of its service providers, reached the bank directly and used its own account to send transfers to other banks, where the money could be converted into cryptocurrency.
How much money was stolen from Arkéa?
The bank has not published an exact figure. It acknowledged the order of magnitude of €118 million ($133 million) reported in the press. Blockchain investigator ZachXBT, who first flagged the theft, tracked more than $106 million and then a further $27 million in withdrawals from exchange accounts. Part of the funds has been blocked.
Were Arkéa customers affected?
The bank says customer assets were not affected and the attackers did not go through customer accounts. Some transfers were delayed because the bank briefly halted certain operations as a precaution. It has also warned customers about phishing messages that exploit the incident.
Which service provider was used in the attack?
Arkéa has not named the provider or explained how the attackers crossed from that platform into its environment. It has ruled out its online bank Fortuneo as the entry point and rejected reports that internal human error was the cause.
What does DORA require after an incident like this?
In the EU, the Digital Operational Resilience Act has applied to banks and payment firms since January 17, 2025. It requires a register and risk management of ICT third-party providers, contracts with audit and exit rights, and staged reporting of major ICT incidents, starting with an initial notification within hours of classifying the incident.
Sources
Crédit Mutuel Arkéa — Additional information following the attack (primary source, November 2026)
BleepingComputer — Hackers pull off $133 million French bank heist via service provider (November 7, 2026)
The Record by Recorded Future News — French bank confirms cyber heist (November 4, 2026)
Help Net Security — $133 million stolen from French bank via exploited service provider (November 9, 2026)