VULNpocalypse
HighBreach / campaignOngoing

Crédit Mutuel Arkéa confirms cyberattack and fraudulent transfers via a supplier, with a reported $133M loss

Crédit Mutuel Arkéa confirmed a sophisticated attack through a service provider that enabled fraudulent transfers, while the reported $133 million loss is

Published
Updated
Exploitation
Yes, the bank confirmed the attack enabled fraudulent transactions; the loss amount is not confirmed

What happened

French banking group Crédit Mutuel Arkéa confirmed a cyberattack that enabled fraudulent transactions, after reports that hackers had stolen an estimated $133 million. The bank says the incident is contained, operations are gradually resuming and customer assets are unaffected (Cybersecurity News).

Timeline and reported figures. Blockchain investigator ZachXBT first reported the activity on Monday, initially without naming the victim, and later named Arkéa as the alleged victim. He said the attack ran over several days (The Record). His first findings identified more than $106 million withdrawn on November 1, and a further $27 million pushed his estimate above $133 million. These are investigative estimates, not losses verified by the bank (Cybersecurity News). The bank disclosed the incident on November 4, 2026 (The 420).

How the attackers got in, according to the bank. Arkéa said the attackers “gone through the platform of one of our service providers” to reach the banking group directly, and used the bank’s own account to send transfers to other banking institutions. That route could then potentially have let them convert the money into cryptocurrency through specialised platforms. The bank called the attack “sophisticated” and not the result of human error, and gave no further details. It did not name the supplier (The Record).

Disputed or unclear points.

  • Fortuneo: local French media alleged the attackers entered through Fortuneo, the online banking subsidiary, and the bank disputed this (The Record). Other reporting said public information did not establish the entry point, a software flaw or any credential theft (Cybersecurity News).
  • Loss amount: Arkéa declined to confirm the estimate but said it could “validate the order of magnitude” (The Record). Another outlet reported the bank saying its actual losses were lower than $133 million (The 420). The final loss is not confirmed, and the bank says it does not threaten its solvency.
  • Cryptocurrency: according to the same reporting, the bank declined to confirm whether stolen assets were held or moved in cryptocurrency (The 420). Arkéa’s own statement, as quoted by The Record, says conversion into cryptocurrency was only a potential outcome. ZachXBT described funds leaving exchange accounts as USDC and USDT, then moving through conversions into Ethereum, cross-chain transfers and exchanges into Monero (Cybersecurity News).
  • Recovery: the bank says some of the converted assets have been frozen and it is working to recover the rest (The Record).
  • Attacker identity, attack start date, duration of access, and whether confidential customer data was accessed: not confirmed (The 420).

The bank notified regulatory and supervisory authorities and temporarily suspended certain transactions, which caused delays on some customer transfers (Cybersecurity News). It says it is working with judicial and police authorities to determine the origin and modus operandi (The Record).

Am I affected?

  • Arkéa customers: the bank says customer accounts were not accessed and customer assets are not impacted (The Record). Some transfers were delayed (Cybersecurity News). The group serves approximately 5.8 million customers (The 420). Whether customer data was exposed is not confirmed.
  • Everyone, including non-customers: Arkéa warned that phishing attempts could follow, as criminals may use news of the incident to make fake security messages look credible (Cybersecurity News).
  • Organisations that supply or integrate with banks: the supplier involved is unnamed, so whether any other organisation is exposed is not confirmed. No CVE or software flaw has been identified, and no patch exists.
  • Other incidents: no evidence connects the BREEZE COMET group or its methods to this incident (Cybersecurity News).

What to do now

  1. Do not share passwords, card details or SMS verification codes with anyone, including callers or messages claiming to investigate the incident (Cybersecurity News).
  2. If you receive a suspicious message about your account, contact your bank adviser directly through official channels instead of replying or following links (The 420).
  3. Monitor your account transactions and verify any security alert through official channels.
  4. If you run a bank, fintech or payment platform, review which suppliers have direct access to your accounts and payment systems, and check for unexpected outbound transfers. This is general guidance, since the supplier and technique are not confirmed.
  5. Watch for updates: Arkéa says further information will follow as it becomes available (Cybersecurity News).

Sources