Hackers Siphon $133 Million From French Bank Crédit Mutuel Arkéa Through a Service Provider

Crédit Mutuel Arkéa, a French cooperative bank with more than 5.8 million members and roughly €211.5 billion in assets, was hit by a cyberattack that let intruders move up to $133 million (€118 million) out of the bank's own accounts, according to a November 7 report from BleepingComputer. The bank disclosed the incident on November 4, saying it was "now closed and under control," but it has not confirmed the dollar figure attached to the theft.

Breaches at banks usually target customer accounts directly. This one didn't. Arkéa says the attacker got in through a service provider's platform rather than through a flaw in its own systems, then used the bank's own institutional account to transact with other financial institutions and convert the proceeds into the stablecoins USDC and USDT. That distinction matters: a breach that routes through a vendor's infrastructure is harder for a bank to catch with its own internal monitoring, since the initial access point sits outside the systems its security team watches directly.

The dollar estimate comes from blockchain investigator ZachXBT, who first flagged unusual withdrawals from multiple centralized exchange accounts in early November and said roughly $30 million had already been laundered by November 3. Arkéa has only gone as far as saying it can "validate the order of magnitude" of ZachXBT's figure, not confirm it outright. Some of the stolen funds have since been blocked, though the bank hasn't said how much.

Arkéa says the intrusion had no impact on client assets — only a delay in processing certain transfers — and that it ruled out its online bank Fortuneo as a source of the breach. It has called in judicial authorities and police to trace the attack's origin, and it's warning customers to expect a wave of phishing attempts that try to piggyback on news of the breach, telling them to verify any suspicious messages by phone with their adviser rather than clicking through.

The incident lands in the same week Binance disclosed a $6.3 billion hack, the largest crypto theft on record, keeping cryptocurrency-linked financial crime in the headlines. For banks, it's a reminder that vendor risk is now bank risk: a service provider's security posture can become the weakest link in an institution's own defenses, no matter how well-guarded its primary systems are. BleepingComputer's Bill Toulas reported the story; Crédit Mutuel Arkéa had not responded to the outlet's request for comment by publication.