Crédit Mutuel Arkéa confirmed on Wednesday that it had been the victim of a major cyberattack that enabled fraudulent transactions. According to initial investigations, $133 million, or approximately €118 million, was diverted before being transferred to several cryptocurrency platforms. The Breton banking group states that it has regained control of the situation and assures its customers that they will not suffer any financial losses.
A cyberattack was revealed after millions of dollars disappeared.
The case began on Sunday, November 1st, when suspicious financial transactions were detected on several cryptocurrency exchanges. Blockchain transaction investigator ZachXBT identified withdrawals initially totaling over $106 million, before uncovering an additional $27 million.
In the early hours of Wednesday morning, he publicly identified Crédit Mutuel Arkéa as the victim of this attack. The total amount mentioned has now reached $133 million, or approximately €118 million. This figure has not yet been confirmed by the bank, which is continuing to assess the financial consequences of the attack.
Crédit Mutuel Arkéa, headquartered in Le Relecq-Kerhuon, near Brest, includes the Crédit Mutuel federations of Brittany and the Southwest, as well as the online bank Fortuneo. It is a separate banking group from Crédit Mutuel Alliance Fédérale, which includes CIC.
Fortuneo was allegedly used to embezzle funds
According to initial findings, the fraud primarily targeted Fortuneo, the online bank owned by Crédit Mutuel Arkéa. The perpetrators apparently managed to transfer funds to accounts opened on cryptocurrency exchange platforms, before converting the received sums into digital assets.
The fraudsters reportedly used accounts whose identities and beneficiary names allowed them to bypass certain banking controls. Transfers were then allegedly made to accounts associated with Kraken, Crypto.com, and other specialized platforms.
This method allegedly allowed euros to be diverted out of the traditional banking system before being converted into cryptocurrencies. Investigators are now trying to determine how the perpetrators obtained the necessary access to initiate these operations and bypass security measures.
The precise role of Fortuneo and the technical details of the fraud have not yet been officially detailed by Crédit Mutuel Arkéa.
The bank confirms the attack and suspends certain transactions
Faced with the scale of the affair, Crédit Mutuel Arkéa acknowledged on Wednesday that it had suffered a cyberattack that enabled fraudulent transactions. In a statement, the bank indicated that the incident was "now under control."
The bank stated: "As soon as this attack was detected, our teams immediately mobilized and, as a precautionary measure, decided to temporarily suspend certain transactions in order to secure operations and prevent any further fraudulent activity."
This decision led to restrictions on certain banking operations. The group announced that these would resume quickly, after final security checks.
Crédit Mutuel Arkéa also sought to reassure its customers, stating that the incident "has no financial consequences for them" and that their interests were fully protected. The group announced no losses incurred by account holders.
Millions converted into cryptocurrencies and spread across multiple platforms
Analysis of financial transactions has made it possible to trace some of the embezzled funds. The specialized firm Bitquery identified $108,8 million in withdrawals of stablecoins—cryptocurrencies whose value is generally pegged to a traditional currency—from several platforms between November 1st and 2nd.
Part of the funds was then allegedly converted into ether and distributed among hundreds of digital wallets. Other amounts were reportedly exchanged for Monero, a cryptocurrency that masks transaction information and significantly complicates the work of investigators.
Crypto.com has confirmed it has taken steps to freeze funds associated with this case. Kraken has also indicated it has restricted accounts linked to suspicious activity. The platforms involved maintain that their own security systems have not been compromised.
The damage could exceed 118 million euros.
The figure of 118 million euros could still change. The investigations are focusing in particular on possible transfers made outside of transactions directly observable on public blockchains, notably through over-the-counter transactions.
At this stage, the perpetrators have not been identified. Investigators must also determine whether the fraudsters exploited a computer vulnerability, compromised bank access, or human error to trigger the transfers.
This scandal was revealed a few days after the record-breaking Binance hack, during which $6,3 billion in assets were stolen . However, the two attacks have different characteristics: in the case of Arkéa, the initial evidence points to bank fraud followed by a conversion of funds into cryptocurrencies.
The North Korean hacking group Lazarus, suspected in the attack against Binance, whose platform announced it had recovered a large part of its assets , has not been identified as responsible for the operation targeting Arkéa.
The bank assures that the group's 5,6 million customers will not suffer any losses.
Crédit Mutuel Arkéa has approximately 5,6 million customers across its various activities, including over one million for Fortuneo. The bank stated that it has informed the relevant authorities and initiated the necessary checks to secure its operations.
The Bank of France has also reportedly been notified of the incident. The banking group, which posted a net profit of €230 million in the first half of 2026, has not yet released a final figure for the damages.
The bank assured that the temporarily suspended transactions would resume "quickly, under optimal security conditions ," once the checks were completed. It did not specify a date for full restoration or detail the technical measures deployed to prevent further fraud.
Respond to the article
Be the first to comment on this article.