French Bank Crédit Mutuel Arkéa Confirms Cyberattack Amid Reports of $133 Million Theft

French banking group Crédit Mutuel Arkéa has confirmed a cyberattack that enabled fraudulent transactions, following reports linking the institution to cryptocurrency theft exceeding $133 million.

The bank says the incident is contained, operations are gradually resuming, and customer assets remain unaffected. It has not confirmed the reported loss figure.

The group notified regulatory and supervisory authorities after detecting the attack. Teams temporarily suspended certain transactions to prevent further fraud while checking systems and adding security measures. According to its statement, customers experienced delays involving some transfers, but their funds remain protected.

Blockchain investigator ZachXBT linked Arkéa to suspicious cryptocurrency withdrawals after initially describing the victim as an unnamed European institution.

His first findings identified more than $106 million withdrawn on November 1. An additional $27 million later pushed his estimate above $133 million. These figures remain investigative estimates, not losses verified by the bank.

The case draws attention to fraudulent payments moving through financial channels. Cybersecurity News previously covered BREEZE COMET’s attacks on financial firms, which involved trusted access and unauthorized transfers. However, no evidence currently connects that group or its methods to the Arkéa incident.

Crédit Mutuel Arkéa Confirms Cyberattack

According to ZachXBT’s published findings, funds left exchange accounts as USDC and USDT before being moved through cryptocurrency services.

He described conversions into Ethereum, transfers between blockchains, and exchanges into Monero. His analysis suggests the final total could be higher if additional over-the-counter trades are included.

In its official incident statement, Arkéa says the affected amounts are still being assessed and do not threaten its financial strength. Separate AFP reporting confirms that the institution has not disclosed how attackers gained access or identified those responsible. This distinction separates the confirmed banking incident from the wider claims about stolen cryptocurrency.

Public reporting has linked the fraud to Fortuneo, Arkéa’s online banking subsidiary. However, the available information does not establish the initial entry point, a specific software flaw, or whether stolen credentials were involved. Claims about the attackers’ identity should therefore remain separate from confirmed findings.

Arkéa also warned that phishing attempts could follow the incident. Criminals may use news of banking problems to make fake security messages seem credible.

Cybersecurity News has previously documented payment scams using spoofed bank alerts, where callers trick victims into sending funds to attacker-controlled accounts. That report describes a separate scam, not Arkéa’s confirmed attack method.

The bank advises customers never to share passwords, card details, or SMS verification codes. Anyone receiving a suspicious message should contact their bank adviser directly. Arkéa says its teams continue assessing the consequences and strengthening security, with further updates expected when new information becomes available.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.