Crédit Mutuel Arkéa, the Brittany-based French banking group, has confirmed that attackers came in through a service provider’s platform and moved money out of the bank’s own account, in a theft that a blockchain investigator puts at more than $133 million. No customer accounts were touched, but for any UK bank, building society or payments firm that lets a third party near its money-moving systems, the lessons are uncomfortable.
What happened
The first public sign came on 2 November 2026. The pseudonymous blockchain investigator ZachXBT reported that an unnamed European financial institution had lost more than $106 million in stablecoins, withdrawn through accounts at several cryptocurrency exchanges. A day later he logged a further $27 million in withdrawals, which took his estimate past $133 million (roughly €118 million). On 4 November he named Crédit Mutuel Arkéa.
The Brest-based group runs Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest and around 40 subsidiaries, including the online bank Fortuneo. It confirmed the same day that it had suffered an attack that allowed fraudulent transactions to be carried out. In later statements, reported by The Record and Presse-citron, it said the intruders had passed through the platform of one of its service providers. That gave them direct access to the group, and they used the bank’s own account to send transfers to other banks. From there the money appears to have been converted into cryptocurrency.
Arkéa described the attack as sophisticated and external, and said it was not the result of human error on its side. It rejected French media reports that the way in was through Fortuneo. It declined to endorse the $133 million estimate, while accepting that it reflected the right “order of magnitude”. It added that part of the money had been blocked, that recovery work was under way, and that the loss posed no threat to its solvency. Some transfers were suspended and executed late; almost all operations have since resumed. It has informed its supervisors and is working with police and judicial authorities. It has not named the supplier.
The technical picture
The bank has said nothing about the intrusion technique, so the most important question, how a supplier’s platform turned into the power to send money, is still open. What is public comes mostly from the money trail.
According to an analysis by Bitquery, cited by IT-Connect, about $108.8 million in USDC left accounts at Kraken, Crypto.com and OKX over roughly 21 hours on 1 and 2 November. It went to 15 wallets, and Kraken accounted for about 95% of the outflow. Close to $63 million of stablecoins was then swapped for around 27,553 ETH through UniswapX in about four hours, with no freeze by Circle, which issues USDC. Some then moved through bridges and instant-exchange services into Monero. Bitquery found that Tether froze only about 1.14 million USDT. It also found that 11 of the 15 receiving wallets had taken payments from the same exchanges as far back as May, which IT-Connect says could point to an operation prepared well in advance.
The French journalist Grégory Raymond has suggested that the stolen money was ordinary currency, not crypto. On his account it was wired to exchange accounts opened under false identities that passed know-your-customer checks, probably through a network of money mules. This has not been confirmed. Presse-citron reports that ZachXBT does not believe the theft is linked to North Korea’s Lazarus group.
Why it matters for UK organisations
This was not a customer data breach. Nobody’s savings were touched, and the victim was the bank’s own balance sheet. That is exactly why it should worry UK financial firms. Most fraud controls are built around customer accounts: transaction monitoring, confirmation of payee and APP fraud reimbursement. Far less attention goes to the accounts a firm uses for its own treasury, settlement and supplier payments. An attacker who can make those systems issue legitimate-looking instructions is effectively spending the institution’s own money.
The supplier route matters too. Under the PRA and FCA operational resilience rules, UK firms have had to stay within impact tolerances for their important business services since March 2025, and that means mapping the third parties those services rely on. The critical third parties regime, in force since January 2025, gives regulators direct oversight of suppliers that HM Treasury designates as critical. Neither removes a firm’s own accountability. Arkéa falls under the EU’s DORA, which asks much the same questions about ICT third-party risk. The incident is a timely test of whether those registers of third parties describe real access paths or just contracts.
Expert view
When we test financial organisations, the payment estate is rarely the weakest point on its own. The weakness is usually where something else meets it: a vendor’s support portal, a managed file transfer service, or an integration account that can submit payment files without the same scrutiny a human operator would face. That access is often reviewed far less often than staff access.
In my experience, the question boards should ask is not “is our supplier secure?” but “if our supplier were fully compromised tonight, what could an attacker instruct our systems to do, and how quickly would we notice?” Arkéa says its monitoring caught the activity very quickly. Even so, the outflow on the exchange side ran for more than a day. Detection that does not include the power to stop payments, or to claw them back fast, limits the damage but does not prevent it.
The laundering side shows how prepared these crews are. Exchange accounts that apparently passed identity checks, wallets that may have been primed months ahead, and swaps completed before any issuer froze them suggest planning that goes well beyond a single intrusion.
What to do now
- Map every route by which a third party can start, approve or change a payment. Include API integrations, payment file uploads, service accounts and vendor support tools, not just interactive logins.
- Put the firm’s own accounts under the same scrutiny as customer accounts. Apply velocity limits, unusual-beneficiary checks and anomaly detection to treasury, settlement and corporate accounts.
- Require independent approval for high-value payments that come through supplier-linked channels. A compromised integration should not be able to approve its own instructions.
- Tighten supplier access in line with Cyber Essentials. Use least privilege, phishing-resistant multi-factor authentication, time-limited access, and prompt removal of dormant vendor accounts.
- Test it. Run a scenario exercise, ideally backed by a red team assessment, that starts from a fully compromised supplier and measures how long it takes to detect, freeze and recall payments.
- Check your operational resilience mapping. Make sure important business service maps and third-party registers show actual technical access, and agree in advance how you would stop payments and contact counterparties within your impact tolerances.
Bottom line
Arkéa’s customers seem to have escaped harm, and the bank says the loss is affordable. But the core of the incident, a supplier’s platform used to move the bank’s own money at scale, is a scenario many UK firms have not modelled properly. Until the bank says how the provider was compromised, the safe assumption is that any supplier able to touch payment flows deserves the same scrutiny as a privileged administrator.
Sources
- The Record: French bank confirms cyber heist, hackers suspected to have stolen an estimated $133 million
- IT-Connect: Braquage numérique au Crédit Mutuel Arkéa, la banque confirme l’attaque
- Presse-citron: Fraude chez Crédit Mutuel Arkéa, la banque en dit plus sur la cyberattaque
- crypto.news: French bank Crédit Mutuel Arkéa hit by $133M cyberattack, funds may have moved to crypto
