"Crédit Mutuel Arkéa wishes to reassure all its clients - across its federations and subsidiaries - that this incident has no impact on their assets; it has merely resulted in a delay in the execution of certain transfer transactions," the bank said, in a machine-translated statement.
Crédit Mutuel Arkéa: the bank's public account
Crédit Mutuel Arkéa acknowledged a significant cyber incident in public disclosures made on November 4, saying the situation "is now closed and under control" and that operations were gradually returning to normal. The group — described in its disclosure as a major French banking organization with more than 5.8 million members and 211.5 billion euros in assets — emphasized customer assets were unaffected while conceding a delay in some transfers. The bank warned customers of heightened phishing risk and urged verification of unsolicited messages by calling a bank adviser directly.
How the attacker moved money: service provider access, Arkéa's account, stablecoins
Arkéa said the attacker reached its network via a service provider's platform and that the intruder then used the bank's own account — not customer accounts — to transact with other banking institutions and convert funds into cryptocurrency. The bank explicitly ruled out Fortuneo as the service provider implicated in the intrusion.
Blockchain fraud investigator ZachXBT reported an unauthorized withdrawal from multiple centralized exchange accounts on November 1 and suggested the attacker may have stolen up to 118 million euros (reported as $133 million). According to ZachXBT's account, the withdrawn funds were converted into USDC and USDT stablecoins. Arkéa declined to confirm the 118 million euro figure, saying only that it could "validate the order of magnitude," and the bank acknowledged that some funds had been blocked.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTimeline and public reporting: Nov. 1–4
- November 1: ZachXBT reported a large-scale unauthorized withdrawal from multiple centralized exchange accounts (ZachXBT described the withdrawal as occurring "a day earlier" relative to Nov. 2 reporting).
- November 2: Public reports surfaced through ZachXBT about the withdrawals; the investigator warned of a large-scale unauthorized withdrawal and noted the lack of public disclosure initially.
- By November 3: ZachXBT warned the attacker had been able to launder about $30 million, funds that the investigator suggested EU law enforcement would otherwise have frozen.
- November 4: Crédit Mutuel Arkéa publicly disclosed the incident, affirmed customer assets were not impacted, and described operations as returning to normal.
What this means for blockchain investigators, judicial authorities, and customers
- Blockchain investigators: ZachXBT's early public analysis tied withdrawals to conversions into USDC and USDT and flagged rapid laundering activity (about $30 million by November 3), illustrating how investigators use on-chain signals and exchange-related tracing to estimate stolen amounts and laundering patterns.
- Judicial authorities and police: Arkéa is working with judicial authorities and police to determine the attack's origin and modus operandi. The bank's cooperation with law enforcement will be central to efforts to trace and, where possible, recover funds that have been blocked.
- Customers of Arkéa: The bank has assured customers that their assets were not affected, but warned that some transfers were delayed and cautioned clients about an increased risk of phishing or fraudulent outreach following the incident.
Technical characterization and immediate actions
Arkéa described the incident as a "sophisticated attack" and explicitly ruled out internal human error as the cause. The bank said the attacker exploited a platform belonging to a service provider to gain access to Arkéa's network and carry out transactions from the bank's own account. Arkéa has blocked some funds and is investigating the precise origin and mechanisms with authorities. BleepingComputer contacted Crédit Mutuel Arkéa for further details and had not received a response at the time of reporting.
The facts reported so far frame this as a complex compromise that combined a third-party platform vector with rapid conversion into stablecoins. Arkéa's assurances that customer assets remain safe sit alongside an unresolved tally of total losses — the bank would not confirm the 118 million euro figure asserted by ZachXBT, acknowledging only that the magnitude was significant and that some funds were blocked. The next concrete developments will be the findings shared by judicial authorities and whether blocked amounts are recoverable.
