French cooperative banking and insurance group Crédit Mutuel Arkéa has confirmed it was the target of a sophisticated cyberattack that resulted in the unauthorized execution of fraudulent financial transactions. The incident, which the bank disclosed on November 4, 2026, involved attackers gaining access to the institution’s internal systems through a third-party service provider. Once inside, the perpetrators utilized the bank’s own accounts to transfer funds to external banking organizations.
While Crédit Mutuel Arkéa has not publicly disclosed the exact financial impact, it has acknowledged that the losses are significant. Independent researchers and industry observers have estimated the theft to be in the range of €100 million to €118 million, or approximately $133 million. The bank has declined to confirm these specific figures, stating only that the estimates provided by outside parties align with the general order of magnitude of the incident.
The stolen funds were reportedly converted into stablecoins, specifically USDC and USDT, before being laundered across multiple blockchain networks. Blockchain analysis suggests that the illicit actors aggressively swapped these assets for Ethereum and utilized various instant exchange platforms and privacy-focused services to move the capital. Researchers monitoring the movement of these funds noted that the lack of immediate public disclosure by the bank may have provided the attackers with enough time to successfully launder roughly $30 million before authorities could intervene.
Crédit Mutuel Arkéa has officially stated that the incident is now contained and under control. The bank emphasized that customer assets were not compromised during the breach, though it noted that some legitimate transfers were delayed while systems were temporarily suspended for security verification. Operations have since resumed, and the bank has implemented enhanced security measures across its infrastructure.
The bank has explicitly ruled out internal human error as the cause of the breach, characterizing the event as a sophisticated external attack. In response to the incident, the group has engaged with relevant regulatory and supervisory authorities. Furthermore, the Paris prosecutor’s cybercrime unit has launched an official investigation, with French cybercrime police leading the efforts to identify the perpetrators and determine the precise technical path used to exploit the third-party provider.
Despite the complexity of the laundering patterns, security researchers have indicated that the attack does not bear the typical hallmarks of the Lazarus Group, a state-sponsored threat actor often associated with large-scale financial heists. The identity of the attackers remains unknown, and no group has claimed responsibility for the operation.
In the wake of the breach, Crédit Mutuel Arkéa has issued warnings to its customers regarding an increased risk of phishing attempts. The institution is urging clients to remain vigilant and avoid sharing sensitive personal or financial information. The bank continues to work alongside law enforcement agencies to track the stolen funds and further investigate the vulnerabilities that allowed the unauthorized access to occur.
