Hackers Hit French Bank Crédit Mutuel Arkéa for About €100 Million, and the Trail Leads to Crypto

CryptocurrencyCrypto
Written by Methodical Millions
Illustration of a classical bank vault spilling glowing emerald coins through a cracked padlock into a network of blockchain cubes on a navy background

The French cooperative bank says hackers used its own account, reached through a service provider, to send money out that could then be turned into crypto. Customers' money is safe, it says, but the case shows crypto rails now sit right next to traditional banking.

By Methodical Jon | Nov 4, 2026

French bank Crédit Mutuel Arkéa says it was hit by a cyberattack that allowed "fraudulent transactions," and it's now trying to claw the money back. The bank put the attack at about €100 million (roughly $112 million USD) in a provisional estimate on Wednesday evening, according to AFP via France 24. Paris prosecutors have opened a criminal investigation, and the bank says customer accounts were never touched.

What happened

In a question-and-answer note on its website, the bank explained how the attack worked. The attackers got in through the platform of one of its service providers and reached Crédit Mutuel Arkéa directly. They then used the bank's own account to send transactions to other banks, which "potentially" let them convert the money into cryptocurrency through specialized platforms.

A few other details from the bank:

  • No customer accounts were used. Accounts at its federations and subsidiaries weren't involved, and the bank denied French press reports that the attackers came in through its online bank, Fortuneo.
  • Not human error. It called this "a sophisticated attack from outside" that is now contained.
  • Transfers were delayed. As a precaution, the bank briefly suspended some transactions. It said nearly all operations resumed Wednesday morning after extra security checks.
  • Some money is frozen. Part of the funds has been blocked, and other recovery efforts are underway.

The bank also warned customers to watch for phishing attempts, which often follow a high-profile attack like this one.

How big is it, really?

The numbers have moved all day, so here's where they stand. On Monday, on-chain investigator ZachXBT flagged that an unnamed EU entity had lost more than $106 million USD from accounts at several crypto exchanges on November 1st, with the funds withdrawn as the USDC and USDT stablecoins, Decrypt reported. He raised that to more than $133 million on Tuesday and then named Crédit Mutuel Arkéa. He said he suspects the total is higher once over-the-counter trades are counted.

The bank hasn't confirmed his figure. On Wednesday morning, a spokesperson told Reuters the losses were lower than $133 million and that "it is still too early to give a final figure." Its later Q&A said it could "validate the order of magnitude" of the €118 million ($133 million) figure, without confirming it. AFP then reported the provisional estimate of about €100 million. In short: it's around a hundred million euros, the final number isn't known yet, and some of it may be recovered.

For scale, Reuters says the bank has 5.8 million clients and €211.5 billion ($238 billion USD) in assets. It earned €230 million in net profit in the first half of the year, according to AFP. The bank says the loss is "absolutely not" big enough to threaten its financial health.

The investigation

The Paris prosecutor's cybercrime section received a complaint from the bank on Wednesday and "immediately opened an investigation," Les Echos reported. The probe covers an attack on an automated data processing system by an organized group, and it's been handed to France's national anti-cybercrime office. Nobody has claimed the attack. ZachXBT said he was highly confident it was not North Korea's Lazarus Group, the group linked to last week's record $6.3 billion USD Binance hack.

Why it matters

Most crypto hacks hit crypto companies. This one hit a traditional bank, and crypto looks like the getaway car. The bank's own explanation describes money moving from its account to other banks and then, potentially, through crypto platforms. ZachXBT's trail describes stablecoin withdrawals, swaps into ether, and moves across several blockchains. That's a reminder that once money crosses from bank rails onto public blockchains, it can move fast and across borders.

It also shows the weak point is often the supply chain. The bank says the way in was a service provider's platform, not its own staff. That's the same lesson regulators keep pushing, and the EU's DORA rules (the Digital Operational Resilience Act) pay particular attention to incidents that start with third-party tech providers, Ledger Insights noted.

And it's awkward timing for crypto's push into mainstream finance. Decrypt notes the bank has been preparing to offer crypto services to its own retail customers under MiCA, the EU's crypto rulebook. Combined with Binance and the Mercado Bitcoin incident earlier this week, security is now the main story in crypto.

What to watch next

Watch for the final loss figure and how much of it is frozen or recovered. Watch whether exchanges or stablecoin issuers announce freezes tied to the addresses ZachXBT published. Watch which service provider was involved, and whether other banks used it. And watch for any statement from French or EU supervisors.

The money lesson

1. Your vendors are part of your security. The bank says it wasn't breached through its own people. The attackers came in through a provider. For any business, the weakest outside partner can become your front door.

2. Early numbers are estimates, not facts. We've seen $106 million, then $133 million, then "lower than $133 million," then about €100 million in one week. Wait for confirmed figures before reacting to a headline.

3. Speed of detection decides the damage. Part of the money was blocked because it was caught. The faster an attack is spotted, the more of it can be frozen.

4. Know where your money actually sits. The bank says customer deposits were untouched because the attackers used its own account. Understanding how your bank, broker or exchange separates customer funds from its own is worth five minutes of your time.

The stolen funds reportedly left exchanges as stablecoins, which ties straight back to Episode 66 - Dai Stablecoin. That episode is a good primer on what stablecoins are and why the way they're built matters, including whether anyone can freeze them.

At the time of writing, Crédit Mutuel Arkéa had not confirmed a final loss figure, said whether the funds were converted into crypto beyond calling it a possibility, or named the service provider involved. This article is for informational purposes only and is not financial advice.

Sources:

Thanks for reading another Methodical Minute. To read more just like this, please subscribe below and share with someone you know.

This article may be AI-assisted and is subject to errors and omissions.

Methodical Millions https://methodicalmillions.com
Next

SpaceX Picks Qualcomm for Starlink Mobile’s 5G Network, With Tens of Thousands of Cell Sites Starting in 2027