Crédit Mutuel Arkéa loses around €100 million in cyberattack routed through a third-party provider

On 4 November 2026, Crédit Mutuel Arkéa — a French mutual banking group headquartered near Brest in Brittany, with more than 5.8 million customers and some €211.5 billion in assets — confirmed that it had been the victim of a cyberattack that enabled "fraudulent transactions." The following day the bank said that attackers had made off with around €100 million (about $112 million). Blockchain investigator ZachXBT and several French outlets put the figure higher, at roughly €118 million (about $133 million); the bank declined to confirm an exact amount but accepted that the order of magnitude was correct while its teams assessed the financial consequences.

According to the bank, the intruders did not break into its own systems directly. Instead they used the platform of an unnamed third-party service provider to reach Crédit Mutuel Arkéa, then leveraged an account belonging to the bank to send fraudulent transfers to other institutions. The funds were not originally held in cryptocurrency, but the bank said they could have been converted into crypto after the theft; French reporting indicated that part of the proceeds had been swapped into Monero. The bank explicitly rejected media reports that its online banking subsidiary Fortuneo had been the point of entry.

Response

Crédit Mutuel Arkéa said it had temporarily suspended some transactions as a precaution, which delayed certain transfers, and that customer assets were not affected. It filed a complaint that the Paris prosecutor's cybercrime unit received on 4 November, opening an investigation led by France's cybercrime police, and it also notified the European Central Bank and French banking supervisors. The group said the sums involved did not threaten its financial health, and it warned clients to beware of phishing messages impersonating the bank to harvest passwords and security codes.

Why it matters

The theft is one of the largest publicly reported against a European bank in recent years and lands in the same window as a wave of high-value financial and cryptocurrency thefts in late 2026. Because the attackers reached the bank through a supplier rather than its own perimeter, the episode is a reminder that a financial institution's security is only as strong as the third parties authorised to move money on its behalf — and that once stolen funds are pushed on-chain and swapped into privacy coins, recovery becomes far harder.