Hackers Steal $133M From French Bank Arkéa Via Third-Party Breach

French cooperative banking group Crédit Mutuel Arkéa has confirmed that attackers breached its systems and carried out fraudulent transactions worth tens of millions of euros. Blockchain investigator ZachXBT estimates the total theft at roughly 118 million EUR, or about $133 million USD, which the attacker converted into cryptocurrency stablecoins.

The bank says the intruders reached its network through a service provider's platform and then used Arkéa's own account to move the money. Customer balances remain untouched, according to the group, although the incident forced it to suspend certain transactions while security teams contained the attack.

Crédit Mutuel Arkéa operates as a cooperative banking and financial services group headquartered in Brest, in the Brittany region of western France. The group brings together the Crédit Mutuel de Bretagne and Crédit Mutuel du Sud-Ouest federations, their local branches, and about forty specialized subsidiaries.

These subsidiaries include the online bank Fortuneo, the payment specialist Monext, the insurer Suravenir, and several asset management and corporate banking units. The group employs 12,073 people, serves more than 5.8 million members and customers, and reports a total balance sheet of 211.5 billion EUR.

Public reports about the incident first surfaced on November 2, when blockchain fraud investigator ZachXBT flagged a large unauthorized withdrawal on his Telegram channel. He traced the activity to multiple centralized exchange accounts and reported that the suspicious withdrawals had occurred the day before, on November 1.

In a follow-up post, ZachXBT said he had identified more than 27 million USD in additional exchange withdrawals linked to the same malicious actor. This discovery raised his estimate for the full incident to over 133 million USD, and he noted that some withdrawals continued even after his initial warning.

At that stage, the investigator did not name the victim, but he suspected that attackers had compromised a large financial institution in Western Europe. He went further, accusing the unnamed organization of hiding the breach and claiming in his post that the incident was "currently being covered up."

According to ZachXBT, the absence of a proper disclosure allowed the attacker to launder more than 30 million USD that EU law enforcement could have frozen. He also published four blockchain wallet addresses tied to the theft, which lets exchanges and analysts monitor any further movement of the stolen funds.

Arkéa Confirms the Attack

Crédit Mutuel Arkéa publicly disclosed the incident on November 4 through a press release issued from its Brest headquarters at around 1 PM local time. The bank stated that it had fallen victim to an attack that enabled fraudulent operations, and it immediately informed the relevant supervisory authorities.

As a precaution, the group temporarily suspended certain transactions to secure its operations and prevent any additional fraudulent transfers from leaving its accounts. Arkéa described the incident as closed and under control, and it said operations would resume gradually after teams completed checks and reinforced security measures.

The group also moved quickly to reassure customers across its federations and subsidiaries, insisting that the attack did not affect their savings or account balances. According to the bank, the only visible consequence for clients was a delay in executing certain transfer operations during the suspension period. Arkéa added that the amounts involved, which it was still assessing, posed no threat to the group's solidity or overall financial health.

Later that day, Arkéa published a separate FAQ page that addressed the main questions it had received following the initial press release. In it, the bank explained that the attackers gained entry via one of its service providers' platforms and accessed Arkéa's systems directly. The bank did not name the provider and has not shared technical details about the vulnerability or the access method the intruders exploited. Arkéa also rejected press reports claiming that the attackers had entered through Fortuneo, stating that no intrusion took place through its online banking subsidiary.

Once inside, the attackers did not touch customer accounts belonging to the federations or subsidiaries; instead, they targeted the bank's own funds. Each stage moved the money further away from the traditional banking system, making recovery more difficult for investigators and law enforcement. Based on the bank's explanation and the investigator's blockchain analysis, the theft appears to have followed a clear sequence of steps:

• The attackers accessed Arkéa's network via a compromised service provider platform, bypassing the need to compromise any individual customer accounts.
• They then used Arkéa's own institutional account to send a series of transfers to accounts held at several other banking organizations.
• Those funds then likely passed through specialized platforms, where the attackers converted them into cryptocurrency, according to the bank's own description.
• ZachXBT tracked withdrawals from multiple centralized exchange accounts using USDC and USDT, which the attacker then began laundering.

When journalists asked whether the attackers had stolen 118 million EUR, Arkéa declined to confirm the exact figure circulating in media coverage and online. In its FAQ, the bank stated, "We do not confirm this information and can only validate the order of magnitude." This careful wording suggests that the actual losses broadly align with the investigator's estimate, even if the final amount may differ.

The bank's teams continue to assess the financial impact, and Arkéa says it has already blocked part of the funds involved in the theft. Additional recovery efforts are underway, but the group considers it too early to announce a definitive figure for the total losses it has incurred.

Arkéa ruled out human error by its own staff as the cause of the breach and instead described the incident as a sophisticated external attack. The bank credited its security systems with quickly spotting the suspicious activity, which allowed its teams to contain the intrusion and limit further damage. Its specialists now work alongside judicial and police authorities to determine the exact origin of the attack and the methods used by the threat actors. None of the published statements identify the threat actor behind the theft, and neither the bank nor ZachXBT has attributed it to a known group.

The bank also cautioned clients that criminals may try to capitalize on the news by launching phishing campaigns that impersonate Arkéa or its subsidiaries. Arkéa described its phishing warning as a preventive measure, explaining that scammers often exploit high-profile attacks like this one to steal confidential information. The group urged customers to stay highly vigilant and to follow several basic precautions whenever they receive unexpected messages or phone calls:

• Customers should never share login identifiers, passwords, or payment card numbers with anyone who contacts them by phone, email, or text.
• They should never disclose one-time validation codes received via SMS, since attackers often use them to approve fraudulent transactions.
• Anyone who receives a suspicious message should contact their bank adviser directly through a known number to confirm whether the communication is genuine.
• Users should treat urgent requests referencing the cyberattack with extra caution, as fraudsters frequently fabricate security alerts to pressure their victims.

The Arkéa breach highlights how third-party service providers can serve as a direct gateway to the core systems of even large, well-protected financial institutions. Banks increasingly rely on external platforms for payments, software, and operational services, and each connection expands the attack surface available to criminals.

The incident also shows how quickly threat actors can move stolen money into stablecoins, where it can cross borders within minutes of a transfer. ZachXBT's criticism underscores a growing debate over disclosure timing, since a faster public warning might have enabled authorities to freeze more of the funds.

Crédit Mutuel Arkéa has promised to share further updates as soon as new information becomes available from its internal review and the police investigation. BleepingComputer, which covered the bank's confirmation, said it had contacted Arkéa for more details but had not received a response at the time of publication. Until the investigation concludes, Arkéa customers should stay alert to suspicious communications and verify any unusual request directly with their bank before taking action.