Crédit Mutuel Arkéa Cyberattack: Hackers Steal €100 Million in Rare Bank Heist

Hackers have stolen around €100 million from a French bank in a cyberattack so rare that security experts are calling it unprecedented in Europe. The money was taken from Crédit Mutuel Arkéa, a co-operative bank based in Brittany, and the bank says it is now working to try to get the money back.

The attack was made public on Wednesday, 4 November 2026. On Thursday, the bank confirmed that about €100 million — roughly $112.61 million — was missing and that it could not yet say how much of it would be recovered.

For most people, a bank robbery brings to mind masked thieves and a getaway car. This one was very different. There were no alarms, no broken doors and no hostages. The thieves worked through computers, moving money with fraudulent transactions — and by the time the bank realised what was happening, the money was already on its way out.

What happened at Crédit Mutuel Arkéa

Crédit Mutuel Arkéa said in a statement on Wednesday that attackers had used an account belonging to the bank to carry out “fraudulent transactions” to other banks. The money itself was not in the form of cryptocurrency, the bank said, but it could have been converted into crypto after being stolen, through specialised platforms.

As soon as the bank discovered the attack, it suspended some transactions as a precaution, to secure its systems and stop any further fraudulent transfers. The result was that many customers could not log in to the bank’s app on Wednesday morning, and some transfers were delayed.

The bank has stressed one point again and again: customer accounts were not involved, and customer assets were not affected. The money stolen did not come from individual customers’ accounts — or, if it did in any way, the bank will cover the losses. “We want to reassure all our customers: this incident has no financial impact on them,” a spokesperson told the magazine Capital.

That matters, because the first thing most customers want to know after news like this is simple: is my money safe? According to the bank, the answer is yes.

How the theft was spotted

The case was first uncovered not by the bank, but by an independent cryptocurrency investigator known as ZachXBT. On 2 November, he reported suspicious withdrawals totalling more than $106 million. He later revised his estimate to more than $133 million — around €118 million.

The bank has not confirmed ZachXBT’s figure. Its own figure, given on Thursday, is about €100 million. Some cryptocurrency platforms have already frozen some of the funds linked to the attack, according to the financial website Boursorama, which may help the bank recover part of the money.

The precise details of how the attackers got in have not been disclosed. Several media outlets, citing anonymous sources, reported that the fraudulent transfers were made from Fortuneo, the group’s online bank, to accounts opened under false identities on cryptocurrency platforms. But the bank has pushed back on that claim. A spokesperson rejected reports that Fortuneo was the entry point for the attack, saying there had been no “entry” through Fortuneo and that neither the division nor its customers’ accounts were involved.

The spokesperson also declined to identify the third-party service provider whose platform was used in the attack. That detail matters, because it suggests the attackers may not have broken into the bank’s own systems directly, but instead found a way in through a company the bank works with. Security experts say this is a growing pattern: instead of attacking a well-defended bank head-on, criminals look for a weaker link in the chain of companies connected to it.

The investigation

The Paris prosecutor’s office said its cybercrime unit received a complaint from Crédit Mutuel Arkéa on Wednesday and immediately opened an investigation into an organised attack on an automated data processing system. The investigation is being led by France’s cybercrime police.

The bank said it had informed the European Central Bank, French banking supervisors and prosecutors. France’s banking regulator, the ACPR, declined to comment.

Recovering stolen money is a race against time. Once funds are moved into cryptocurrency and passed through several wallets and platforms, they become much harder to trace — and harder still to freeze. That is why the freezing of some funds by crypto platforms, reported this week, is a hopeful sign for the bank, even if nobody can yet say how much will come back.

Why this attack is so unusual

Cyberattacks are common. Banks are attacked every day. What is rare is for the attackers to actually get away with the money.

“While cyberattacks are common, it was unusual for money to be stolen virtually from a bank,” Reuters reported. Rafay Baloch, chief executive of the cybersecurity firm RedSecLabs, told Reuters the Crédit Mutuel attack was unprecedented in Europe.

“We’re seeing a lot of these sophisticated attacks targeted at the application layer and sophisticated social engineering attacks being targeted at banking institutions,” Baloch said.

In plain language, that means the attackers did not necessarily break through a firewall with brute force. They may have tricked people, or found a weakness in the software banks use to process transactions. Social engineering means manipulating people into giving up access — a fake email, a phone call pretending to be from a supplier, a login page that looks real but is not.

Puneet Kakkar, managing director at the investigations firm Nardello & Co in Paris, told Reuters that French banks typically have strong cybersecurity because of strict regulatory requirements. “Still, cybercriminals are becoming more opportunistic and more creative,” he said. “Any time you have a hit in the financial system, it’s a big deal.”

Financial regulators around the world have stepped up warnings about the risk of cyberattacks, particularly as artificial intelligence gives criminals new tools. AI can be used to write more convincing phishing emails, to copy a person’s voice on a phone call, or to find weaknesses in software faster than before.

A bad week for digital security

The Crédit Mutuel Arkéa attack did not happen in isolation. It came just a week after the theft of $6.3 billion in cryptocurrency from Binance, one of the world’s largest crypto exchanges. It also followed a wave of cyberattacks targeting internet-connected fridges in Europe — a reminder that almost any device connected to the internet can become a target.

France has seen major everyday services hit before. In late December 2025, a cyberattack on La Poste disrupted its parcel service Colissimo and La Banque Postale for several days. The Arkéa case stands out for the scale of the money involved — among the largest sums ever reported stolen from a French bank.

There is a longer history of successful bank cyber-heists around the world. In 2016, attackers stole $81 million from the Bangladesh central bank’s account at the Federal Reserve Bank of New York. Millions of dollars have also previously been stolen from banks in Russia and India during cyberattacks, Reuters has reported. But cases on this scale, against a mainstream European bank, remain rare.

Who is Crédit Mutuel Arkéa?

Crédit Mutuel Arkéa is a French co-operative banking group based in Brittany, with its headquarters at Le Relecq-Kerhuon, near Brest. It has more than 5.8 million customers and €211.5 billion in assets.

The group includes the Crédit Mutuel de Bretagne and Crédit Mutuel du Sud-Ouest federations, as well as several subsidiaries, including the online bank Fortuneo. It is part of the wider Crédit Mutuel banking network and is affiliated with its central body, while keeping significant strategic autonomy.

It should not be confused with the rest of Crédit Mutuel and CIC, which belong to a different group. Their customers are not affected by this incident.

For a bank of this size, €100 million is a serious loss, but it is small compared with its total assets of €211.5 billion. The bigger damage may be to trust. Banks run on confidence: customers need to believe their money is safe and that the bank can protect it. An attack like this shakes that confidence, even when no customer loses a single euro.

What should customers do?

The bank says its operations are expected to resume “quickly, under optimal safety conditions” once the final checks are complete. No date or time for a return to normal has been announced.

For customers, the advice is straightforward. Plan ahead for urgent payments: if you need to make a transfer — rent, a tradesperson’s bill, a repayment — warn the recipient of a possible delay, or go through your branch. Check your accounts as soon as access is restored, and report any transaction you do not recognise to your adviser.

There is also a warning about scammers. Criminals often take advantage of news like this to send fake texts, emails or calls pretending to be from the bank. A real bank will never ask for your codes or ask you to approve a transaction you did not start. Do not click on links received by text or email; go directly to the bank’s official app or website. If you are unsure about a message, the French government website Cybermalveillance.gouv.fr can help you identify a scam and find out what to do.

What happens next

Several questions remain unanswered. How did the attackers get in? Which third-party provider’s platform was used? How much of the €100 million can be recovered? And who is behind the attack?

The investigation by French cybercrime police is now under way, and the bank says it is working to recover the money. Some funds have already been frozen on crypto platforms, which is a start — but recovering the full amount will be difficult if the money has already been moved through several accounts and converted into cryptocurrency.

The case is also likely to push regulators and banks across Europe to look again at their defences — not just their own systems, but the systems of every company they work with. As Baloch’s warning makes clear, the attackers are getting more sophisticated, and they are looking for the weakest link in the chain.

For the wider banking industry, the lesson is uncomfortable. A bank can spend millions on cybersecurity, follow every regulation, and still be robbed — not with a gun, but with a keyboard.

Frequently asked questions

How much money was stolen from Crédit Mutuel Arkéa?

Around €100 million (about $112.61 million), according to the bank. An independent crypto investigator, ZachXBT, first flagged suspicious withdrawals of more than $106 million on 2 November, later revising his estimate to more than $133 million (about €118 million). The bank has not confirmed that higher figure.

Were customers’ accounts affected?

No. The bank says the hack did not involve customer accounts and customer assets were not affected. Some transactions were temporarily suspended as a precaution, which caused delays to some transfers and made the app inaccessible for a time.

How did the attackers steal the money?

The bank says the attackers used an account belonging to Crédit Mutuel Arkéa to carry out “fraudulent transactions” to other banks. The funds were not in cryptocurrency, but may have been converted into crypto after being stolen. The exact method of entry has not been disclosed, and the bank has declined to name the third-party service provider whose platform was used.

Is Fortuneo involved?

The bank says no. A spokesperson rejected media reports that its online banking subsidiary Fortuneo was the entry point for the attack, saying there had been no “entry” through Fortuneo and that neither the division nor its customers’ accounts were involved.

What is being done about it?

The Paris prosecutor’s cybercrime unit has opened an investigation, led by France’s cybercrime police. The bank has informed the European Central Bank, French banking supervisors and prosecutors, and says it is working to recover the money. Some cryptocurrency platforms have already frozen some of the funds linked to the attack.

Has this happened to other banks?

Yes, but rarely on this scale in Europe. In 2016, attackers stole $81 million from the Bangladesh central bank’s account at the Federal Reserve Bank of New York. Millions have also been stolen from banks in Russia and India. The Arkéa case has been described by a cybersecurity expert as unprecedented in Europe.

Sources

• Reuters, “French bank Credit Mutuel Arkea says €100 million missing after cyberattack”, 5 November 2026: https://northlandnewsradio.com/2026/11/05/french-bank-credit-mutuel-arkea-says-e100-million-missing-after-cyberattack/
• Sortiraparis (AFP/Europe 1/franceinfo reporting), “Crédit Mutuel Arkéa app down after cyberattack: what customers need to know”, 4 November 2026: https://www.sortiraparis.com/en/news/in-paris/articles/357324-credit-mutuel-arkea-app-down-after-cyberattack-what-customers-need-to-know

This article is for general information and education only. It is not legal or financial advice.