Crédit Mutuel Arkéa: cyberattack with estimates above $133 million

France’s Crédit Mutuel Arkéa confirmed on November 4, 2026 a cyberattack that enabled unauthorized transfers from an account belonging to the bank itself. Onchain investigator ZachXBT estimates that more than $133 million was taken, a figure the bank has not confirmed. According to the bank, customer assets were not affected, while the final size of the loss remains an open question.

How did the cyberattack on Crédit Mutuel Arkéa happen?

The attackers got in through a third-party service provider’s platform and gained access to the bank, according to its explanation as reported by Bitcoin Magazine. They used one of the bank’s own accounts to send money to other banks, from where it was possibly converted into crypto through specialized platforms.

Arkéa denied reports that placed the attackers’ point of entry at Fortuneo, its online banking arm. It described the incident as a sophisticated external attack rather than the result of human error. It also said no customer accounts of its federations or subsidiaries were used.

We think this is one of the key points of the case: a bank’s security also depends on its connections with third parties. Picture an apartment building with an armored front door but another way in through a partner’s premises. Checking only the first door isn’t enough.

How much money was lost and what did ZachXBT find?

The figure of more than $133 million is ZachXBT’s estimate, not a confirmed final tally from the bank. The investigator initially reported suspicious withdrawals of more than $106 million from centralized exchange accounts on November 1, without naming the victim.

According to his analysis, the funds were withdrawn in USDC and USDT, i.e. stablecoins, cryptocurrencies designed to track a stable value. They were then swapped for ether, Ethereum’s native cryptocurrency, and moved across different blockchains. He later spotted further withdrawals of at least $27 million and named Arkéa as the alleged victim.

The bank said it can only confirm the order of magnitude, not the specific amount. AFP reported a provisional estimate of about €100 million, while Reuters reported the bank as saying the losses were lower than $133 million. These reports do not amount to a final count.

What has been confirmed about recovering the funds?

Part of the money has been frozen and steps are being taken to recover the rest, according to Arkéa. The bank said the incident had been brought under control, operations were returning to normal and some transactions had been suspended as a precaution, causing delays to transfers.

It has not disclosed when the attack began, who is behind it or whether any data was taken. It is cooperating with judicial and police authorities and said it notified its supervisors as soon as it detected the incident. It also maintains that the amounts involved do not threaten its financial health.

What should customers watch out for?

The bank’s specific warning to customers concerns possible phishing attempts. Its reassurance about their money doesn’t rule out scam attempts that use the incident as a pretext.

For readers in Greece, the sources point to no impact on any Greek bank. Still, we keep a clear line between what Arkéa officially states and what ZachXBT’s investigation attributes: neither the final amount nor the full path of the attack has been confirmed. Those, along with the amount recovered, are what we are watching from here.