Crédit Mutuel Arkéa Cyberattack: Hackers Steal €100 Million in Rare Bank Heist

Hackers have stolen about €100 million from Crédit Mutuel Arkéa, one of France’s largest regional banks, in a rare and sophisticated cyberattack that turned a third-party platform into a pipeline for moving stolen money into cryptocurrency. The Brittany-based mutual bank said on Thursday, November 5, 2026, that the money went missing after an attack on Wednesday, November 4. It cannot yet say how much it will recover.

No customer accounts were involved and no customers lost money, the bank said. But the Crédit Mutuel Arkéa cyberattack stands out for its method: the attackers used a bank account through a third-party provider’s platform, sent fraudulent transfers to other banks, then converted the funds into crypto. Part of the money was blocked.

Key Points

• About €100 million ($112.61 million) is missing after a cyberattack on Wednesday, November 4, 2026.
• Attackers used a bank account through a third-party provider’s platform for fraudulent transfers, then converted the funds into cryptocurrency.
• US exchange Kraken raised the alarm after unusually large transfers for a European bank and blocked transactions in progress.
• No customer accounts were involved and no customers lost money, the bank said, though some transactions were temporarily suspended.
• The bank has informed the European Central Bank, French supervisors and prosecutors; the Paris prosecutor’s cybercrime unit is investigating.

What Happened

Crédit Mutuel Arkéa disclosed the theft on Thursday, November 5, a day after the attack. According to the bank, the attackers used an account belonging to Arkéa, reached through a third-party service provider’s platform, to carry out fraudulent transfers to other banks. The money was then converted into cryptocurrencies on specialised platforms, a step that makes stolen funds far harder to recover.

The alarm was raised by Kraken, the US cryptocurrency exchange, which noticed unusually large transfers for a European bank arriving on Monday and blocked transactions still in progress. Independent blockchain investigator ZachXBT first spotted the suspicious movements and said the operation did not originate from North Korea, notable because North Korean groups have been blamed for several of the largest crypto thefts. Arkéa called the attack sophisticated, from outside the bank and not the result of human error.

Background and Context

Crédit Mutuel Arkéa is a mutual bank based in Brittany, western France, with more than 5.8 million customers and €211.5 billion in assets. Its annual profit is about €430 million, so the theft equals roughly a quarter of a full year’s earnings — a heavy blow even for a bank of its size.

The heist follows a bruising run of cyber incidents. Just last week, Binance reported a theft of about $6.3 billion, the largest crypto heist ever reported, after an attacker got in through a compromised employee laptop. Europe has also been hit by a wave of cyberattacks on internet-connected refrigeration. Le Monde called the Arkéa case a first for a European bank: a direct, large-scale theft of a bank’s own funds, rather than a ransomware demand or a data breach.

The Crédit Mutuel Arkéa Cyberattack: How the Heist Worked

The heist followed a clear sequence. First, the attackers gained use of an account belonging to Arkéa through a third-party service provider’s platform — the heart of the case, since the entry point was a trusted outside system with access to move money on the bank’s behalf, not necessarily the bank’s own network.

Second, fraudulent transfers went from that account to other banks. Third, the funds were converted into cryptocurrencies on specialised platforms to break the trail. Fourth, Kraken stopped part of the flow, raising the alarm over transfers far larger than normal for a European bank and blocking transactions still in progress. What is not yet public matters too: the bank has not named the third-party provider, said how the attackers got control of the account, or said how much was blocked or frozen.

Reactions and Quotes

Arkéa moved quickly to reassure customers, saying no customer accounts were involved and no customers lost money. The bank called the attack sophisticated, from outside, and not human error. It has informed the European Central Bank, French supervisors and prosecutors, and the Paris prosecutor’s cybercrime unit is investigating an organised attack.

Kraken’s role has drawn praise: the exchange spotted transfers unusually large for a European bank and blocked transactions still in progress, saving at least part of the money. ZachXBT, who first flagged the suspicious movements, said the operation did not originate from North Korea — notable, given that North Korean-linked groups were blamed for the record Binance theft last week. Le Monde called the heist a first for a European bank.

Why It Matters

The Arkéa heist matters for three reasons. First, a bank’s security is only as strong as its weakest supplier: the attackers reached the money through a third-party platform with the power to move it, without defeating the bank’s own defences. Regulators across Europe have warned about exactly this supply-chain risk, and this case is likely to become the example they point to.

Second, it shows how fast stolen money can be converted into cryptocurrency and scattered across platforms; Kraken’s quick action may be why any of it is recoverable at all. Third, it lands when European banks are already under pressure after last week’s $6.3 billion Binance theft and the wave of attacks on connected refrigeration. A €100 million theft from a household-name bank brings that risk home in a way abstract warnings never could.

What Happens Next

The Paris prosecutor’s cybercrime unit is investigating, French supervisors and the European Central Bank have been informed, and regulatory scrutiny is certain. Investigators will trace the funds through the blockchain, working with exchanges to freeze what can still be found and identifying the third-party platform’s role and the attackers behind it. Arkéa will also face questions about its controls: which outside firms can move money on its behalf, how they are vetted, and what checks failed. Customers have been told their money is safe, but with €100 million missing, the bank’s next update — on how much was blocked, frozen and lost for good — will matter most.

Frequently Asked Questions

How much money was stolen from Crédit Mutuel Arkéa?
About €100 million (roughly $112.61 million) went missing after the attack on Wednesday, November 4, 2026. The bank cannot yet say how much it will recover.

Did customers lose money in the Arkéa cyberattack?
No. The bank said no customer accounts were involved and no customers lost money, though some transactions were temporarily suspended.

How did the hackers steal the money?
They used a bank account through a third-party provider’s platform to send fraudulent transfers to other banks, then converted the funds into cryptocurrencies.

Who stopped part of the theft?
The US exchange Kraken raised the alarm over unusually large transfers for a European bank and blocked transactions still in progress. ZachXBT first spotted the suspicious movements.

Who is investigating the Arkéa heist?
The Paris prosecutor’s cybercrime unit is investigating an organised attack. The European Central Bank and French supervisors have also been informed.

Read more on US News Pulse: Binance hack drains $5.7 billion in largest crypto heist, France blood plasma cyberattack: alarms saved the supply, and Ohio auditor cyberattack: foreign actors blamed.