French Bank Hacked: How Crédit Mutuel Arkéa Lost an Estimated $133 Million

Updated November 5, 2026. This is a live story: the bank has not confirmed the final loss, and we'll update this page as the investigation moves.

A French bank was hacked, and the money went out through the front door. Crédit Mutuel Arkéa, the Brittany-based banking group behind the online bank Fortuneo, confirmed on the evening of Wednesday, November 4 that attackers had made fraudulent transfers out of the bank's own account. Blockchain investigator ZachXBT puts the loss at more than $133 million (about €118 million), most of it apparently turned into cryptocurrency within days.

The bank won't confirm that number. But asked about it, the bank said it could "validate the order of magnitude", according to The Record and crypto.news. AFP reported a provisional estimate of around €100 million. Either way, this is one of the largest cyber thefts from a traditional European bank in years, and it arrived less than a week after the record Binance hack.

French bank hacked: the short version

• Who: Crédit Mutuel Arkéa, a cooperative banking group headquartered near Brest. It serves more than 5.8 million members and customers and reports total assets of about €211.5 billion.
• What: Attackers got in "through the platform of one of our service providers", in the bank's words, and used the bank's own account to send money to other financial institutions.
• How much: More than $133 million (€118 million) by ZachXBT's count, and reported in euros by French paper Le Télégramme. The bank says only that the order of magnitude is right. AFP cites a provisional estimate of about €100 million.
• Where the money went: Per ZachXBT, the funds left crypto exchange accounts as the stablecoins USDC and USDT, were swapped into Ether, pushed through instant-exchange services and partly converted into Monero, a privacy coin that is very hard to trace.
• Customers: The bank says customer accounts, savings and assets were not touched, and no customer data theft has been reported. Some transfers were delayed while it paused transactions.
• Investigation: The Paris prosecutor's cybercrime section opened a case on November 4 for an attack on an automated data system "by an organized group" and handed it to France's national anti-cybercrime office (OFAC).
• Still unknown: Who did it, which supplier was used, and how much has been frozen. Nobody has claimed responsibility.

How Crédit Mutuel Arkéa was hacked

Here is what is confirmed, what is reported, and what is still a guess. The bank has said very little on the technical side, so treat anything beyond its statement as reporting, not fact.

Step 1: In through a supplier, not a customer account

The bank's statement says the attackers came in through a third-party service provider's platform and from there "directly" reached Crédit Mutuel Arkéa. It hasn't named the supplier or said what that supplier does.

This is called a supply-chain attack: instead of breaking into the target, attackers break into a company the target trusts and use that trusted connection. It's the same pattern behind many of the biggest incidents of the past few years, and it's hard to defend against because the access looks legitimate.

The bank was firm on two points. It says this was "a sophisticated attack from outside", not an employee's mistake. And it says the attackers did not get in through customer accounts, its regional federations, its subsidiaries, or Fortuneo.

Step 2: Transfers from the bank's own account

Once inside, the attackers used Arkéa's own account, the bank's money rather than any customer's, to send transfers to other banking institutions. According to Le Figaro, as relayed by Presse-citron, the attackers went after the bank's own funds on purpose.

How exactly they got the power to send those payments isn't public. Crypto outlet TechFlow, citing journalist Grégory Raymond, reported that the attackers gained the ability to start outgoing transfers and set the recipient names, which let them slip past the check that matches a payee's name to their account. The bank hasn't confirmed this, so treat it as unverified.

Step 3: Fiat to crypto, through accounts opened under fake names

The receiving accounts appear to have been at crypto platforms. The bank itself says the transfers "potentially" let the attackers convert the money into cryptocurrency through specialised platforms.

Presse-citron reported that the fraud relied on accounts opened under false identities, and named Crypto.com as one destination. TechFlow reported that fake identities were used to pass identity checks (known as KYC, "know your customer") at Kraken and Crypto.com. Neither exchange has commented in the sources we found, and TechFlow said the exchanges' own systems appear intact. In other words, the exchanges look like a route the money used, not victims.

Step 4: Stablecoins, Ether, then Monero

From there, the money moved fast. ZachXBT, the pseudonymous investigator who first flagged the theft, traced withdrawals from centralized exchanges as USDC and USDT. These are stablecoins, crypto tokens pegged one-to-one to the US dollar.

According to TechFlow's summary of his tracking, about $63 million in stablecoins was swapped for 27,553 ETH on the decentralized exchange Uniswap on the night of November 1–2. The funds were then split across instant-swap services and cross-chain bridges, and part of them was converted into Monero (XMR). Monero hides the sender, receiver and amount of every transaction by default, which is why it's popular with thieves who want the trail to go cold.

When the Arkéa hack happened

The timeline below comes from three kinds of sources: the bank, French authorities, and on-chain trackers. Clock times exist only for the earliest crypto movements.

• Sunday, November 1, 12:25 UTC: the first batch of funds left Crypto.com, according to on-chain data firm Bitquery as reported by TechFlow. About 44 minutes later, heavy outflows started from Kraken addresses.
• Night of November 1–2: about $63 million in USDC and USDT was swapped for 27,553 ETH on Uniswap, per ZachXBT's tracking.
• Monday, November 2: ZachXBT posted on Telegram about a suspected theft of more than $106 million from an unnamed Western European financial institution. He later raised the figure to more than $133 million after finding about $27 million in further suspicious withdrawals.
• November 3: ZachXBT publicly questioned why the victim hadn't said anything, and claimed more than $30 million had already been laundered.
• Wednesday, November 4, morning: the Paris prosecutor's cybercrime section received the bank's complaint and opened an investigation.
• November 4, evening: Crédit Mutuel Arkéa confirmed the attack in a press notice.
• November 5: the bank said most operations had resumed and the incident was "under control".

The attack ran over several days, ZachXBT said. That matters, because it's the basis of his sharpest criticism.

How much was stolen from the French bank?

There are three numbers in circulation, and they don't fully agree:

• More than $133 million (about €118 million): ZachXBT's estimate, based on withdrawals from crypto exchange accounts and laundering transactions. Le Télégramme reported it in euros. This is the figure most outlets lead with.
• About €100 million: a provisional estimate reported by AFP.
• "The order of magnitude": the bank's own line. It "does not confirm" the $133 million figure but accepts it's in the right range.

Treat all three as preliminary. ZachXBT's figure counts what he could see moving on-chain. TechFlow noted that some funds may have gone through over-the-counter (OTC) trades off the blockchain, so the true exposure could be higher, or lower if some of the traced money turns out to be unrelated. The bank also says it hasn't confirmed that every transaction ZachXBT identified is linked to its systems.

For scale: Arkéa reported a net profit of €230 million for the first half of the year, per AFP. The bank says the loss is "absolutely not of a nature" to threaten its solvency.

How much has been frozen?

Some. The bank says part of the converted assets has been frozen and it is working to recover the rest. It hasn't said how much, or where.

ZachXBT alleged that delays in alerting the authorities let the attackers launder more than $30 million that European authorities could otherwise have frozen, according to Anadolu Agency. The bank, for its part, says its security systems flagged the activity quickly and its teams suspended transactions straight away. Those two accounts haven't been reconciled.

Who hacked Crédit Mutuel Arkéa?

Nobody knows yet, and nobody has claimed it. AFP noted that, with no claim of responsibility, it isn't even clear whether this was pure theft or an activist operation.

Two things are worth knowing:

• Probably not North Korea, for now. After the Bybit and Binance heists, the first guess for any big crypto-linked theft is North Korea's Lazarus Group. ZachXBT said this case should not be linked to Lazarus, according to Presse-citron. That's his read of the on-chain behaviour, not an official attribution.
• The method looks like a fraud ring, not a state hacking team. Fake-identity exchange accounts, fast stablecoin cash-outs and a Monero exit look more like organized financial crime than the wallet-signing attacks used in recent exchange hacks. That's an inference from the reported pattern, not a finding by investigators.

The prosecutor's own wording is "an organized group". OFAC is leading the investigation.

Is Fortuneo safe? What it means for customers

This is the question many Arkéa and Fortuneo customers are asking. Here is what the bank says:

• Customer accounts weren't used. The money came from the bank's own account.
• Savings and assets aren't affected. The bank says the incident had "no financial consequences for its customers".
• No customer data theft has been reported.
• Fortuneo wasn't the way in. Early French reports, including one from journalist Grégory Raymond, said the fraud ran through Fortuneo. The bank denies this.
• Some transfers were delayed. The bank paused some transactions as a precaution. Most operations resumed within about a day, with full service after final security checks.

The real risk for customers now is phishing. Big news stories about a bank are perfect bait for scammers, and the bank itself has warned about it.

What you should do now

1. Don't trust "security" calls, texts or emails about the hack. The bank says it will never ask for your password, account ID, card number or SMS codes. Anyone asking is a scammer.
2. Don't click links in messages about the incident. Open your banking app or type the address yourself.
3. Check your statements for transfers you don't recognise. The bank says customers weren't hit, but checking costs nothing.
4. Be wary of "refund" or "compensation" offers. There is no customer compensation scheme because customers didn't lose money.
5. If you think you've been phished, call your bank on the number printed on your card and change your passwords. Our guide on what to do after a data breach walks through the rest.

A bad fortnight for finance and supply chains

The Arkéa theft lands in a crowded week. Binance lost about $6.3 billion on October 29. On November 2, Brazil's largest crypto exchange, Mercado Bitcoin, confirmed a cyberattack as millions flowed out of the platform, according to The Record. And in France, hackers reportedly got into a refrigeration contractor's control systems and changed temperature settings at sites of the national blood service, TechTimes reported; staff caught it in time and no blood was lost.

The common thread is the supplier. In the blood-service case it was a refrigeration contractor. At Arkéa it was a service provider's platform. As Gulf News put it in its analysis of the bank attack, an organization "is only as strong as the security of its suppliers and trusted partners". Analysts quoted there point to the usual fixes: checking suppliers' security continuously, tight control of privileged access, and watching high-value transactions for unusual behaviour.

The Arkéa case also shows how fast crypto can make stolen bank money move. By the reported account, the money reached exchange accounts and was in stablecoins, then Ether, then Monero within hours. That's why ZachXBT's complaint about timing matters: every hour before an alert is an hour for the money to disappear.

Crédit Mutuel Arkéa hack FAQ

Was a French bank hacked?

Yes. Crédit Mutuel Arkéa, a cooperative banking group based near Brest in Brittany, confirmed on November 4, 2026 that it was hit by a "sophisticated attack" involving fraudulent transfers from its own account. Blockchain investigator ZachXBT estimates more than $133 million (about €118 million) was taken. The bank hasn't confirmed the figure but says the order of magnitude is right.

How was Crédit Mutuel Arkéa hacked?

The bank says attackers came in through the platform of an unnamed service provider and used Arkéa's own account to send transfers to other financial institutions. From there the money was likely converted to crypto. The bank rules out human error. Further technical details, such as how the attackers got payment powers, are reported by crypto outlets but not confirmed.

How much money was stolen from Crédit Mutuel Arkéa?

More than $133 million (€118 million) according to ZachXBT, who first estimated $106 million and then found about $27 million more in suspicious withdrawals. AFP reported a provisional estimate of around €100 million. The bank says only that it "can validate the order of magnitude". All figures are preliminary, and part of the money has been frozen.

Was Fortuneo hacked?

According to the bank, no. Early French reports said the fraud ran through Fortuneo, Arkéa's online bank with more than a million customers. Crédit Mutuel Arkéa denies that Fortuneo was the entry point and says no customer or subsidiary accounts were used. The attackers took money from the bank's own account, not from Fortuneo customers.

Is my money safe at Crédit Mutuel Arkéa or Fortuneo?

The bank says customer accounts, savings and assets were not affected, and no customer data theft has been reported. Some transfers were delayed for a short time while transactions were paused. The bank says the loss doesn't threaten its solvency. The main risk to customers now is phishing scams that use the news as bait.

Who was behind the Arkéa hack?

Nobody has been identified and nobody has claimed responsibility. The Paris prosecutor describes it as an attack by "an organized group" and has given the case to France's anti-cybercrime office (OFAC). ZachXBT said the case should not be linked to North Korea's Lazarus Group, though that is his reading of the on-chain evidence, not an official finding.

Where did the stolen money go?

According to ZachXBT's tracking, the money reached crypto exchange accounts reportedly opened under fake identities, left as USDC and USDT stablecoins, was swapped into about 27,553 ETH on Uniswap, and was then spread across instant-exchange services and partly converted into Monero, a privacy coin. The bank says some converted assets have been frozen.

Will the money be recovered?

Part of it already has been frozen, the bank says, but it hasn't said how much. Recovering the rest will be hard: ZachXBT says more than $30 million had been laundered before authorities were alerted, and money converted into Monero is extremely difficult to trace. The investigation by French authorities is ongoing.

Want a frank breakdown of a breach, a scam message or a crypto trail? Try uncensored AI on Cleus.

Sources

• The Record: French bank confirms cyber heist, hackers suspected to have stolen an estimated $133 million
• AFP via Yahoo Finance France: Crédit Mutuel Arkéa, cyberattaque pour près de 100 millions d'euros, enquête ouverte
• Anadolu Agency: French bank Arkea confirms cyberattack after reported $133M crypto theft
• crypto.news: Crédit Mutuel Arkéa hit by $133M cyberattack, funds may have moved to crypto
• Presse-citron: Fraude chez Crédit Mutuel Arkéa, la banque en dit plus
• TechFlow: French online bank breached for over $133 million
• Gulf News: French bank cyberattack exposes growing supply chain risk
• TechTimes: France faces cyberattacks targeting blood banks and financial institutions
• The Record: Largest crypto exchange in Brazil confirms cyberattack