French Banking Giant Crédit Mutuel Arkéa Hit by Cyberattack, $133 Million Reportedly Stolen

The French banking group Crédit Mutuel Arkéa announced that a cyberattack caused fraudulent transactions, leading to temporary restrictions on transfers.

Reports suggest the theft may exceed $133 million; however, the bank has not confirmed that amount and maintains that customer assets remain unaffected.

Crédit Mutuel Arkéa Cyberattack

In its official announcement, Arkéa said it contained the incident and gradually resumed operations after security checks. The group contacted regulatory and supervisory authorities after detecting the attack and introduced enhanced safeguards before restoring affected services.

Subsequent reporting provided a clearer account of the intrusion. According to statements attributed to Arkéa, attackers accessed an external service provider’s platform and reached the bank directly. They used Arkéa’s own account to transfer funds to other financial institutions before converting money into cryptocurrency through specialized platforms.

The bank said attackers did not use customer accounts belonging to its federations or subsidiaries. It also rejected suggestions that its online banking subsidiary Fortuneo provided the entry point. Investigators have not publicly identified the compromised provider, exploited vulnerability, malware, or responsible threat actor.

The distinction separates this incident from customer-focused banking malware attacks, where malicious applications intercept credentials and authentication information. Available reporting instead describes unauthorized transactions involving the institution’s own funds.

Blockchain investigator ZachXBT linked Arkéa to suspected losses exceeding $133 million. Reporting described funds moving through cryptocurrency exchanges and being converted into stablecoins. However, the reported total should not be treated as a finalized, independently verified loss.

Arkéa later acknowledged the order of magnitude but did not confirm the exact amount. Some funds have been frozen, and recovery efforts remain underway. The bank maintains that the financial impact does not threaten its financial strength or soundness.

Unlike separately documented cryptocurrency theft campaigns, no public attribution connects this attack to Lazarus or another named group. French prosecutors opened an investigation assigned to the national cybercrime office, OFAC.

Arkéa warned customers about possible phishing attempts exploiting the incident. It urged them never to disclose banking usernames, passwords, card numbers, or SMS validation codes and to verify suspicious messages directly with their advisor.

That warning is relevant to SMS phishing campaigns designed to harvest payment details and one-time passwords. Transfer delays should not be mistaken for evidence that customer balances were stolen.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.