Credit Mutuel Arkea Cyberattack: Up to $133 Million Stolen

The Credit Mutuel Arkea cyberattack, disclosed on November 4, 2026, drove fraudulent transactions of up to about $133 million (roughly €118 million) after an attacker reached the bank through a service provider's platform. Transfers left the bank's own institutional account and were converted into cryptocurrency. Client assets stayed in place, according to the bank.

What did the Credit Mutuel Arkea cyberattack disclosure confirm?

Crédit Mutuel Arkéa confirmed on November 4, 2026 that a cyberattack had enabled fraudulent transactions on the order of $133 million. It had suspended certain systems and considered the incident closed and under control. The French cooperative group has more than 5.8 million members and €211.5 billion in assets.

The bank named no threat actor, malware family, product, or CVE. Police and judicial authorities are working with it on origin and modus operandi. Bill Toulas at BleepingComputer reported the account on November 7, 2026, and said the bank had not answered a request for comment.

The disclosure is narrower than the round number. In its FAQ the bank refused to lock in ZachXBT’s figure. The reported answer was: “Do you confirm that 118 million euros (133 million dollars) were stolen? We do not confirm this information and can only validate the order of magnitude.”

It called the sum significant and said some funds were blocked, without an amount or a description of who blocked them. Which systems were suspended is unpublished. Operations were gradually returning to normal.

“Closed and under control” is a containment claim. The same November 4 statement says the exact origin and the method are still being established.

The November 4 notice runs two claims at once. Containment is asserted. The method is not. Customers were told their assets were safe and that some transfers were only delayed. Investigators were still mapping origin. Both can be true if the payment rail was stopped before the supplier path was reconstructed.

Clients across federations and subsidiaries were told, in a machine translation of the bank’s wording, that the incident “has no impact on their assets” and “has merely resulted in a delay in the execution of certain transfer transactions.” That delay is the only customer-visible effect described.

How did the attacker get in, and whose money moved?

According to the bank’s FAQ, the attacker entered Arkéa’s network directly through a service provider’s platform, then used the bank’s own account to transact with other banking institutions. Fortuneo, an Arkéa subsidiary, was explicitly ruled out as that entry point, with no explanation attached.

The provider is unnamed, and so are the access type and the dwell time. A remote-admin console, a VPN or ZTNA session, a managed service, an API integration, or stolen supplier credentials would all fit the published sentence, and none of those paths is confirmed.

A supplier session does not, by itself, move money. What moved money was authority on an account the bank describes as its own: an institutional or correspondent-style account that can instruct other institutions.

The bank ruled out human error on its side and called the event a “sophisticated attack.” No vulnerability write-up backs that adjective. Until one appears, the phrase means the bank does not think an employee mistyped a payment.

Customer assets, the bank says, were not taken. Arkéa bears the loss, because the transfers came from its own institutional account, and counterparties received them before any block. Members saw delays on some transfers.

What did ZachXBT see before the bank spoke?

ZachXBT’s November 2, 2026 warning is the first public signal, and it predates the bank by two days. He described large unauthorized withdrawals from multiple centralized exchange accounts on November 1, and estimated up to €118 million ($133 million) moved as USDC and USDT. He did not name Arkéa then.

The bank later agreed that funds were converted into cryptocurrency and validated only the order of magnitude. Until Arkéa states a number, the €118 million figure stays his estimate, not the bank’s ledger.

Read the Chainalysis credential exposure as a separate case of downstream token exposure after a crypto-infrastructure breach. It shows speed. It does not identify the Arkéa provider.

USDC and USDT transfers sit on public ledgers, so amounts, timestamps, and destination addresses are generally visible. An address on a block explorer is not a person. Attribution usually needs exchange customer records or other case material.

Tether can freeze USDT at specific addresses. Circle can block an address from moving USDC. An exchange can freeze a balance it still holds. Each action stops further spends from a controlled address. None unwinds a settled transfer or recovers coins that already moved on.

The bank’s line that “some funds were blocked” fits that mechanic and stops there. No hash, chain, token, amount, or issuer is public. The window ZachXBT flagged, from the November 1 withdrawals to whatever was still freezable on November 3, is when a precise hash-and-address package to issuers and exchanges either got sent or did not.

Did the disclosure lag matter for the stablecoins?

The claim that late disclosure let about $30 million move is ZachXBT’s, paraphrased by BleepingComputer, and Arkéa has not adopted it. He said that by November 3 the attacker had laundered roughly $30 million that EU law enforcement might have frozen if the victim had been named sooner.

That is an allegation about a laundering window. It is not confirmation that a freeze request was ready, or that the addresses were still in issuer or exchange custody.

Public disclosure and supervisory reporting run on different clocks. European rules push banks to notify supervisors of major cyber incidents quickly, on tight deadlines. A bank can file that notice without a public post.

Activity on November 1, ZachXBT on November 2, and the bank on November 4 shows only when the public learned the name. It does not show when supervisors did.

DORA, Regulation (EU) 2022/2554, has applied since January 17, 2025. Financial entities must report major ICT-related incidents and manage ICT third-party risk. Using a provider does not transfer those duties. Whether this incident met the major threshold is not public.

A regulatory filing is not the customer FAQ. The path Arkéa described, entry through a supplier platform, is the third-party dependency DORA places on the bank.

The November 4 notice warned customers about phishing. The bank urged people not to share sensitive details by phone or email, and to verify suspicious messages by calling their adviser. A $133 million headline on the retail brand raises that secondary risk. It does not explain the institutional transfers.

What should a security lead test while the vendor is unnamed?

A security lead can still test this without a named vendor, a CVE, or an actor. The confirmed blast radius is an institutional account that can pay other banks, reached from a supplier platform. Hardening retail passwords would not have stopped that.

The check is whether any third party can create, alter, or approve those transfers, and whether that path is monitored as a payment event. In payment-path tests, the break seen most often is dual control that shares one trust boundary.

Two approvers add little if the same supplier access can drive both sessions, rewrite the transaction on screen, or edit limits and beneficiary allowlists. Keep two investigations separate: how the provider session entered, and how it became authority to create and release an institutional transfer.

A VPN record does not answer how a session became authority to release a transfer. Rebuild the chain of identities, roles, payment-service accounts, signing controls, and beneficiary changes, and pull the provider’s raw sign-in and API logs before passwords are reset.

For each integration that touches treasury, payments, or the back office, record the identities, the roles, and four actions: create a transfer, change a beneficiary, raise a limit, and approve a payment. If one supplier session can both initiate and approve, two-person control is not separated.

Before accounts are wiped, preserve identity-provider events, MFA changes, VPN or ZTNA sessions, API logs, and admin actions. Demand the provider’s raw logs. A summary loses the timestamps police will want for November 1 use of the institutional account.

Send exchanges and issuers transaction hashes, chains, token contracts, amounts, destination addresses, UTC timestamps, and a law-enforcement case reference. A public FAQ is not that package. A freeze is not a refund. Arkéa said some funds were blocked and has not shown the amount.

An API penetration testing engagement on the supplier integration asks whether that credential can move a payment object it should only read. An assumed breach assessment starts from the provider session and measures the path to an institutional transfer.

An identity and access review checks which roles that supplier session inherits, including any standing authority at correspondent banks. Treat those actions as treasury events, with the approver, the source IP, and the beneficiary change in the same timeline.

FAQ

Did Credit Mutuel Arkea confirm that €118 million was stolen?

No. In its FAQ the bank said it does not confirm that €118 million ($133 million) figure and can only validate the order of magnitude. It did call the sum significant.

Were Credit Mutuel Arkea customer deposits taken?

The bank says no. It told clients the incident had no impact on their assets and only delayed execution of certain transfer transactions.

Was Fortuneo the entry point for the Arkea attack?

The bank explicitly ruled Fortuneo out. Fortuneo is an Arkéa subsidiary. The FAQ gives no further reason for the exclusion and names a service provider's platform instead, without naming the provider.

What cryptocurrencies were the stolen Arkea funds moved as?

The bank said stolen funds were converted into cryptocurrency. ZachXBT reported the withdrawals as USDC and USDT. Arkéa has not confirmed those tickers or an exact amount.

Has a threat actor or vulnerability been named?

No. No group, malware family, software product, or CVE is public. The bank says it is still establishing origin and modus operandi with police and judicial authorities.

Is the Credit Mutuel Arkea incident still ongoing?

The bank said on November 4 that the incident is closed and under control and that operations were gradually returning to normal. The same statement says the exact origin and method are still under investigation.

If a supplier platform can reach payment initiation and approval, the test starts from that session and ends at a reproduced transfer. agent::offense maps that path in an assumed breach assessment against institutional payment authority.