Arkéa Cyberattack: Bank Confirms Fraud Transfers

Crédit Mutuel Arkéa has confirmed an Arkéa cyberattack that let attackers move money from the bank’s own account. In a regulated statement dated 4 November 2026, the Brittany-based cooperative group said the incident had been contained, that operations were resuming, and that clients’ assets were not affected.

A complementary FAQ published the same day adds the detail that matters most for readers: the attackers did not come in through Fortuneo or through customer federation or subsidiary accounts. They used a service-provider platform to reach Crédit Mutuel Arkéa directly, then sent transfers from the group’s own account toward other banks, which may later have been used to move funds into crypto.

In brief

Crédit Mutuel Arkéa confirms a cyberattack that enabled fraudulent transfers from the bank’s own account.
The path was a service-provider platform, not Fortuneo; the bank says customer assets were unaffected.
An exact figure of €118m ($133m) has been reported by on-chain investigator ZachXBT; the bank will not confirm those numbers and only validates the order of magnitude.

How the Arkéa cyberattack unfolded, according to the bank

On detection, Arkéa says it informed supervisors, suspended some transactions as a precaution, and worked to stop further fraudulent movements. By the morning of 4 November it described the incident as under control, with most operations resumed after extra checks. Some transfers were deferred while that work was under way.

The FAQ is explicit that this was not a human error inside Arkéa, but a sophisticated external attack that security controls spotted quickly. Investigators and police are involved; the bank has not named a group or a country.

On the widely circulated €118 million ($133 million) figure, FAQ question 6 is careful. The bank does not confirm those exact amounts and says it “can simply validate the order of magnitude”. Some funds have been blocked, recovery work continues, and Arkéa says the sums at stake are not enough to threaten the group’s financial strength. On-chain investigator ZachXBT has been cited for the exact figure; TSN treats that number as his claim, not as a bank-confirmed total.

The press release also warns customers about phishing. The FAQ says that warning is preventive: after attacks of this kind, phishing often rises, and the bank is asking customers to stay alert. It does not, by itself, mean customer data was stolen, and TSN does not report a customer-data breach on the basis of these statements.

Why a bank-own-account theft still matters

Attacks that drain a bank’s nostro or treasury account rather than retail wallets are less common in public reporting than card or app breaches, but they sit in the same family of payment-rail abuse that has hit critical infrastructure elsewhere in Europe, including supermarket refrigeration systems. The Arkéa case is also a reminder that trusted service-provider platforms are high-value entry points: once an attacker can instruct payments from a bank’s own account, the fraud looks legitimate to downstream banks until someone notices the pattern.

The possible crypto off-ramp mentioned in the FAQ is why this belongs on TSN’s crypto-exploits timeline as well as the broader cyber one. That does not prove any named exchange was involved, and TSN is not tying this incident to Kraken or any other venue as fact. Earlier reporting that linked exchange account freezes to this story remains unverified on the exchange’s own channels.

For UK and EU readers the immediate lesson is operational: vendor and payment-provider access into core banking systems needs the same scrutiny as internet-facing apps. End-of-life or lightly patched infrastructure elsewhere, from SonicWall GMS to large set-top botnet takedowns, shows how long trusted gear can stay exposed once it is no longer a priority. Arkéa’s next updates should clarify a final loss figure and whether any provider contract or control failed; until then, the confirmed facts stop at the bank’s own account, the service-provider path, and an order-of-magnitude loss the bank will not pin to €118m.