Crédit Mutuel Arkéa Loses €100M Through Vendor Platform

Attackers moved roughly €100 million out of an account belonging to French cooperative lender Crédit Mutuel Arkéa after getting in through the platform of an outside service provider, the bank said in statements issued on November 4 and 5, 2026. Arkéa, a Brittany group with €211.5 billion in assets and over 5.8 million customers, said the money left its own account rather than customer balances, that containment held up some outgoing transfers, and that part of the funds had been frozen. The Paris prosecutor's office opened a criminal inquiry, and the bank declined to name the provider.

Outside observers spotted the theft before the bank spoke. On November 2, blockchain investigator ZachXBT posted a warning that an unnamed European entity appeared to have lost more than $106 million through withdrawals from several centralized exchange accounts the previous day. He wrote that the funds left as USDC and USDT stablecoins, were swapped for ether, passed through instant exchange services and were partly converted to Monero. A day later he logged a further $27 million in withdrawals he tied to the same actor, for a total near $133 million, and said laundering indicators did not point to North Korea's Lazarus Group.

ZachXBT also criticized the silence. According to BleepingComputer, he said the lack of a public disclosure let the attacker launder about $30 million by November 3, money he believed European police could otherwise have frozen. On November 4 he named Arkéa as the likely victim. French regional daily Le Télégramme put the loss at more than €118 million, roughly $133 million. Asked about that number in a question and answer document published the same evening, Arkéa said it could not confirm it and could only validate the order of magnitude.

The bank's account of the mechanics was short. Arkéa wrote that the intruders used the group's own account to send payments to other banks, and that the money may then have been turned into cryptocurrency on specialized platforms. It rejected press reports that its online bank Fortuneo was the way in, saying the attackers instead went through a service provider's platform and reached the group directly. It blamed no staff mistake, calling the event a sophisticated outside attack that its monitoring flagged quickly, and said nearly all operations had resumed by the morning of November 4 after checks and added safeguards.

Earlier reporting suggested a slightly different picture. French journalist Grégory Raymond posted on X that, according to his sources, the fraudsters set the beneficiary names on outgoing transfers themselves and sent each payment to an exchange account opened under a false identity that exactly matched that name, so the transfer would pass name-matching checks. Help Net Security relayed that account, which Arkéa has not confirmed. Reuters reported that the bank had informed the European Central Bank and French supervisors, while the ACPR, the French banking regulator, declined to comment. The news agency called the theft a rare case of criminals taking money straight from a mainstream bank and pointed to the 2016 heist in which $81 million was taken from Bangladesh Bank's reserves held at the New York Fed.

Recovery remains incomplete. Hackread reported that Daniel Baal, president of the national Crédit Mutuel confederation, said on France 5 on November 6 that some of the money had been recovered, without giving an amount. Arkéa said the final cost was still under review and posed no threat to its financial soundness. It also warned customers to expect phishing that exploits the news and told them never to share passwords, card numbers or SMS codes. The bank described that warning as a precaution and said nothing it had disclosed showed customer data was taken.

The incident underscores that any vendor whose platform can reach a payment system belongs inside the bank's payment control boundary. Banks and insurers should map every third party with a technical route to treasury or wire functions and confirm that such access cannot release funds to a new beneficiary without separate approval. Auditors can test outbound limits that aggregate a firm's own accounts across all sending systems over several days, review alerting on large transfers to crypto exchanges, and confirm that incident plans set clear triggers for early notice to regulators and law enforcement. In the EU, DORA already requires financial firms to register ICT providers and report major incidents, and in the US the 2023 interagency guidance on third-party relationships sets similar expectations.