French cooperative banking group Credit Mutuel Arkea confirmed on Wednesday, November 4, 2026, that it suffered a cyberattack which enabled fraudulent transactions. The bank says the incident is now under control, operations are resuming, and customers suffer no financial impact, because customer accounts were not used and the bank own account was affected instead. The bank has not confirmed an exact amount stolen. It validates only the order of magnitude of the reported figure, which independent investigators have put at more than 133 million dollars, or about 118 million euros.
That careful wording matters, because the headline number and the confirmed number are not the same thing. Independent blockchain investigator ZachXBT first flagged more than 106 million dollars in suspicious withdrawals from an unnamed European entity on November 2, then raised the estimate to more than 133 million dollars and named Arkea. News agency AFP reported a provisional estimate of about 100 million euros, while Reuters reported that the bank said losses were lower than 133 million dollars. In short, a very large fraud is confirmed, a precise total is not, and part of the funds has been frozen while recovery steps continue.
Quick Facts
| Detail | What is known |
|---|---|
| Bank | Credit Mutuel Arkea, French cooperative banking group |
| Confirmed | Wednesday, November 4, 2026 |
| What happened | Cyberattack enabling fraudulent transactions |
| Customer impact | Bank says none; customer accounts were not used |
| Exact amount | Not confirmed by the bank; only the order of magnitude validated |
| Reported estimate | More than 133 million dollars, about 118 million euros, per ZachXBT |
| Entry point | Bank says through a platform of one of its service providers |
| Headquarters | Le Relecq-Kerhuon, near Brest, France |
| Customers | About 5.6 million |
| Recovery | Part of the funds frozen; recovery steps under way |
What the Bank Has Confirmed
Credit Mutuel Arkea statement is short but covers the points customers most need. First, there was a cyberattack. Second, that attack enabled fraudulent transactions. Third, the incident is now under control and operations are resuming. Fourth, customers suffer no financial impact. The bank makes a clear distinction here: the money at issue came from the bank own account, not from customer accounts. That distinction matters for customers reading alarming headlines.
The bank has also addressed how the attackers got in, at least in broad terms. It said the attackers came through a platform belonging to one of its service providers, and it rejected claims that its online bank Fortuneo was the entry point. That rejection matters because Fortuneo is a well known brand within the group, and early speculation online often links a breach to the most visible consumer brand. By naming a service provider platform instead, the bank is pointing to the supply chain, a part of banking that customers rarely see but that attackers increasingly target. The bank has not, in the material available, named that provider, and readers should not guess at its identity.
Where the 133 Million Dollar Figure Comes From
The large number in headlines did not come from the bank. It came from ZachXBT, an independent blockchain investigator who tracks suspicious crypto movements in public. On November 2, ZachXBT first flagged more than 106 million dollars in suspicious withdrawals from an unnamed European entity. The estimate was then raised to more than 133 million dollars, about 118 million euros, and Arkea was named as the entity involved. That sequence explains why early reports were vague about the victim and why later reports were specific: the investigator work developed over two days, not in a single post.
Other outlets have given slightly different provisional figures, which is normal when money is moving across blockchains and through exchanges in real time. AFP reported a provisional estimate of about 100 million euros. Reuters reported that the bank said losses were lower than 133 million dollars. None of those figures should be treated as a final audited loss. The bank itself validates only the order of magnitude, which in plain language means the scale is broadly right, in the region of one hundred million, without confirming the exact dollar or euro total. Until the bank or investigators publish a final accounting, any single number should be described as reported or estimated, not as confirmed.
The On Chain Trail, Explained Carefully
Blockchain data gives investigators a trail that traditional bank fraud often does not, because many crypto transfers are visible on public ledgers even when the people behind the wallets are not known. In this case, two different measurements have been reported, and it is important not to add them together as if they were separate pots of money. Bitquery, a blockchain data firm, counted about 62.98 million dollars in stablecoins converted into 27,553 Ether in about four hours through UniswapX, a decentralised exchange route. Separately, about 108.8 million dollars in USDC was reported leaving in 178 transactions to 15 wallets over roughly 21 hours between November 1 and 2.
Those are different measurements of a fast moving flow, not two clean totals to be summed into a larger headline. Money can be counted at different stages, in different coins, and over different windows, and the same funds can appear in more than one measurement as they move. That is why adding 62.98 million and 108.8 million together would be misleading, and why this article does not do so. What the on chain trail does show, even without a final total, is speed and scale: tens of millions moved in hours, across many transactions and wallets, which is consistent with a well planned operation rather than a single accidental transfer.
Why This Attack Matters Beyond One Bank
Credit Mutuel Arkea is not a small local bank. It is a cooperative group with about 5.6 million customers, headquartered at Le Relecq-Kerhuon near Brest in Brittany. It should not be confused with the separate Credit Mutuel Alliance Federale and CIC group, which is a different organisation despite the similar name. That confusion is common in French banking, where several cooperative groups share historic roots, and it is worth correcting plainly: this incident concerns Arkea, not the Alliance Federale group.
The wider lesson is about third party risk. Banks spend heavily on their own defences, but they also rely on service providers for platforms, payments and other functions. If an attacker can enter through a provider, the bank own firewall is not the only line of defence that matters. Regulators in Europe have been warning about this for years, and incidents like this one give that warning a concrete example. For other banks, the question will not be whether they have a provider, because almost all do, but whether they can see what that provider is doing, limit what it can access, and shut down a route quickly when something goes wrong. Arkea says its incident is now under control, which suggests that shutdown happened, but the full timeline of detection and response has not yet been published.
What Customers Should Do Now
For Arkea customers, the bank message is reassuring on the key point: no financial impact for customers, because customer accounts were not used. Customers do not need to move money in panic, and they should be wary of anyone who contacts them claiming to help with this incident. Fraudsters often follow a real breach with fake messages, pretending to be the bank and asking for login details or codes. A real bank will not ask for a full password or a one time code by phone, text or email, and any message that creates urgency about this attack should be checked through the bank official app or website, not through a link in the message itself.
For everyone else, the incident is a reminder to use the basic protections that still matter most: a unique password for banking, two factor authentication where offered, and alerts for transactions. Those steps do not stop a bank level attack through a provider, but they do limit the damage from the follow on scams that usually appear after a headline breach. Customers who notice any transaction they do not recognise should still report it at once, even if the bank says customer accounts were not used in this case. Reporting quickly is always better than waiting to see whether a problem sorts itself out.
Readers who want context on other recent crypto and cyber incidents can read our coverage of the Binance hack postmortem and the North Korea link, which shows how large crypto thefts are investigated. Our report on the hack affecting French blood banks and freezers is another French case where an attack had real world effects beyond money. And the recent cyberattacks on supermarkets across ten European countries show the same pattern of disruption spreading across borders.
Frequently Asked Questions
Did Credit Mutuel Arkea lose 133 million dollars?
The bank has not confirmed that exact figure. It validates only the order of magnitude of the reported figure. ZachXBT estimated more than 133 million dollars, AFP gave a provisional estimate of about 100 million euros, and Reuters reported the bank said losses were lower than 133 million dollars. The precise total remains unconfirmed.
Are customers affected?
The bank says customers suffer no financial impact, because customer accounts were not used and the bank own account was affected. Operations are resuming after the incident was brought under control.
How did the attackers get in?
The bank said attackers came through a platform of one of its service providers. It rejected claims that its online bank Fortuneo was the entry point. The provider has not been named in the material available.
Has any money been recovered?
Part of the funds has been frozen and recovery steps are under way, according to reporting on the case. A final recovered total has not been published, so readers should treat recovery as in progress, not complete.
Sources
- Bitcoin Magazine: Credit Mutuel Arkea hack, 133 million dollars reported
- Brussels Signal: French bank Credit Mutuel Arkea confirms cyber attack
- Sortiraparis: Credit Mutuel Arkea app down after cyberattack, what customers need to know
Final Thoughts
The Credit Mutuel Arkea case is a study in how to read a breaking cyber story. The confirmed core is serious enough on its own: a major French banking group suffered a cyberattack, fraudulent transactions followed, and the incident is now under control with no customer financial impact claimed. The headline number, more than 133 million dollars, is a reported estimate from an independent investigator, broadly validated in scale by the bank but not confirmed in exact terms. Keeping those two levels separate, confirmed versus reported, is the honest way to follow the story as recovery continues and as a final total, if one is published, replaces the early estimates.
