Crédit Mutuel Arkéa Loses Up to $133M Through a Service Provider, and Three Days of Silence Cost Another $30M

On November 1, someone moved as much as 118 million euros ($133 million) out of Crédit Mutuel Arkéa. They did not touch a single customer account. They used the bank's own. For three days, the only public sign that anything had happened came from an independent blockchain investigator tracking the money, not from the bank.

Crédit Mutuel Arkéa is a French cooperative banking group with more than 5.8 million members and 211.5 billion euros in assets. According to reporting by Bill Toulas at BleepingComputer, the attacker got into the bank's network through a service provider's platform. From there they started transactions from Arkéa's own account to other banking institutions and turned the proceeds into USDC and USDT stablecoins. The bank responded by suspending certain systems.

How the money moved

Here is the timeline pieced together from the investigator's public warnings and the bank's own statements:

• November 1: Large-scale unauthorized withdrawals from multiple centralized exchange accounts, later reported to total up to 118 million euros, taken out as USDC and USDT.
• November 2: Blockchain fraud investigator ZachXBT publicly warns about the theft without naming the victim.
• November 3: According to ZachXBT, the attacker has laundered $30 million that EU law enforcement could otherwise have frozen, because nobody had disclosed the theft.
• November 4: Crédit Mutuel Arkéa discloses the incident and says it "is now closed and under control."

In a separate FAQ, the bank said the attacker came in directly through a service provider's platform. It ruled out Fortuneo as the source but did not name the provider. It neither confirmed nor rejected the 118 million euro figure: "We do not confirm this information and can only validate the order of magnitude." It said some funds were blocked. It ruled out human error at the bank and called the incident a "sophisticated attack." The bank says it is still working with judicial authorities and police to establish the attack's exact origin and how it was carried out.

"Customer assets are safe" is not the whole story

Arkéa's message to customers was that the incident "has no impact on their assets; it has merely resulted in a delay in the execution of certain transfer transactions." Based on what the bank has said, that is accurate: the money came from the institution's own account, not from members' balances. But the loss is still real. It falls on the bank's balance sheet, and in a cooperative, the members own that balance sheet.

The bank also warned about a second wave: more phishing. It told customers to watch for unsolicited messages, not to share sensitive details by phone or email, and to check anything suspicious by calling their adviser directly. That warning is appropriate. A breach headline with a nine-figure number gives scammers the perfect reason to call worried customers.

The RedEye take

This was not a data breach. It was a payment authority breach, and the industry still mostly runs vendor risk as if those were the same thing. Most third-party assessments ask what data a provider can see. The question that mattered here is what money a provider's platform could move. If one external platform gave an attacker a path to send treasury-scale transfers from the bank's own account to other institutions, and keep sending them until the total reached nine figures, that platform was effectively a privileged insider. It should have been controlled like one.

We also think Arkéa spoke too soon. Ruling out human error, and calling the attack sophisticated, while police are still establishing how it was carried out puts the conclusion ahead of the evidence. "Sophisticated" may turn out to be correct. It may also turn out to describe an ordinary weakness in a trusted connection. Defenders should wait for the root cause before accepting that label.

The most expensive decision in this incident may not have been technical. ZachXBT's figures suggest the three days between theft and disclosure were worth $30 million to the attacker. In a crypto cash-out, staying quiet does not protect anyone. It helps the thief.

What defenders should learn

• Vendor risk has to cover money movement, not just data. The useful inventory is which third-party platforms can start or approve transfers from your corporate and treasury accounts, and how much they can move.
• An institution's own accounts are a target. Banks apply velocity checks, beneficiary scrutiny and out-of-band approval to customer transfers. An attacker who goes after the bank's own account is counting on those controls being weaker there.
• The time to disclose is also the time to recover. When stolen funds become stablecoins, freeze requests to exchanges, issuers and law enforcement compete with the launderer. Institutions that set up those contacts before an incident can act in hours, not days.
• Follow-on phishing is part of the incident. Arkéa's warning was correct, but customer messaging, adviser call-back procedures and verification scripts work best when they are ready before the headline breaks.
• Don't announce a root cause before the investigation has one. Statements like "no human error" or "sophisticated attack" are hard to take back, and they can steer internal review away from the trusted connection that actually failed.

The bottom line

Arkéa's customers kept their money. The bank did not, and neither did the investigators who might have frozen $30 million with an earlier warning. For any institution that connects third-party platforms to its payment systems, the question this incident raises is how much money a single trusted connection can move before anyone stops it, and how quickly the institution would say so publicly.

Source: Bill Toulas, "Hackers pull off $133 million French bank heist via service provider," BleepingComputer, November 7, 2026.