Hackers drained French bank Arkéa's own account. It calls a $133 million estimate about right
Crédit Mutuel Arkéa confirmed a cyberattack that sent fraudulent transfers out of the bank's own account, possibly into crypto. It denies the attackers came in through Fortuneo and says customer savings are safe.
Key points
- Crédit Mutuel Arkéa said on November 4, 2026, that a cyberattack let attackers carry out fraudulent transactions, and that it alerted the relevant supervisors.
- The bank said the attackers used Arkéa's own account to send transfers to other banks, which may have let them convert the money into crypto. Customer accounts were not used.
- Arkéa did not confirm the reported €118 million ($133 million) loss, but said the order of magnitude is roughly right. Some funds have been blocked.
What the bank confirmed
Crédit Mutuel Arkéa, the French cooperative bank based in Brest, said on Wednesday, November 4, 2026, that it was hit by a cyberattack that made fraudulent transactions possible. In its first statement, the group said it had informed the relevant supervisory authorities and had paused some transactions as a precaution.
The bank said the incident was closed and under control, and that services were coming back step by step. It said customer savings were not affected, although some transfers were delayed. It added that the amounts were still being assessed and did not threaten the group's financial health. In a later statement it said it was working with judicial and police authorities to establish how the attack was carried out.
How the money left
Later the same day, Arkéa published a second statement with more detail. According to the bank, the attackers used Arkéa's own account, not customer accounts, to send transfers to other banks. The bank said those transfers may have allowed the attackers to turn the money into cryptocurrency.
The bank said accounts belonging to customers of its regional federations and subsidiaries were not used in the attack. It rejected the idea that a staff mistake caused the breach and described the attack as "sophisticated" and coming from outside (our translation from French).
The $133 million question
A loss of about €118 million ($133 million) circulated publicly after the attack. Arkéa's second statement quotes that figure as a question and does not confirm it. It said only that the order of magnitude was roughly right, and that the final amount is not yet known.
The bank also said part of the funds has been blocked and that work to recover more is under way. It did not say how much was blocked, which banks or crypto platforms received the transfers, or which tokens were used.
LC Insight could not verify the on-chain trail on a primary source, so we do not report wallet amounts or routes here.
Fortuneo and the third-party platform
Arkéa also addressed claims about Fortuneo, its online bank. In its second statement, Arkéa said no entry was made through Fortuneo and that the attackers went through the platform of a third-party provider. It did not name the provider.
That detail matters. It suggests the weak point was a service connected to the bank, not the bank's customer-facing apps. Arkéa has not published a technical report, so how the attackers reached that platform is still unknown.
What customers should do
Arkéa warned that phishing attempts often rise after an attack like this. Criminals often send fake messages that pretend to come from the bank. In its first statement, the bank told customers to:
- never share login details, card numbers or SMS codes;
- contact their own adviser directly if a message looks odd.
The bank did not say that customer data was stolen.
Timeline
Arkéa announces it was the victim of a cyberattack that enabled fraudulent transactions, and says supervisors were informed.
Arkéa publishes additional information: its own account was used, Fortuneo was not the entry point, a third-party platform was, and some funds are blocked.
LC Insight analysis
This section is our reading of the facts above, not a statement of fact.
- We think the key detail is that the money came from the bank's own account. That makes this a loss for Arkéa itself, which fits its message that customers keep their savings.
- A third-party platform as the entry point is a familiar pattern: attackers go after the connected supplier with weaker defenses. The likely result is closer checks by supervisors on bank suppliers, not only on banks.
- If part of the money did end up in crypto, the blocked share will depend on how fast exchanges and token issuers acted. The bank has not said how much that is yet.
What's next
- A final loss figure from Arkéa
- How much of the money was blocked or recovered
- The name of the third-party provider and any statement from it
- Any public action by French supervisors or prosecutors
Disclaimer. This article is based on public information and the sources listed below as of the update time shown. It is for information only and is not investment, legal or tax advice. Figures may change as companies and authorities publish new data.
