French cooperative banking group Crédit Mutuel Arkéa has confirmed that it has fallen victim to a major cyber attack resulting in fraudulent transactions, following revelations that hackers siphoned off more than $133 million (€118 million) through cryptocurrency rails.
The admission came after blockchain investigator ZachXBT, who has previously assisted law enforcement in tracing stolen crypto-assets, identified Arkéa, a Brittany-based cooperative banking network with over €230 billion in total assets, as the targeted European institution.
Headquartered in Le Relecq-Kerhuon, near Brest in northwest France, Arkéa had some 5.6 million customers at the end of 2025.
According to forensic transaction data, the attack unfolded over several days. ZachXBT first flagged more than $106 million (€94 million) in suspicious withdrawals on November 2, before raising his estimate to $133 million two days later.
The bank did not disclose the exact amount of stolen funds, but the investigator said that the stolen amount could even be higher once over-the-counter trades were taken into account.
Attackers systematically drained capital from centralised exchange accounts, withdrawing it as the dollar-pegged stablecoins USDC and USDT and swapping it across decentralised finance platforms before moving it off-platform.
Blockchain analytics firm Bitquery said $62.98 million (€55.9 million) in stablecoins was converted into 27,553 Ether in about four hours through the decentralised exchange UniswapX.
Cryptocurrencies are increasingly being used to make quick payments and transfers at a lower cost, avoiding market fluctuations, BFMTV noted.
ZachXBT alleged that delays by the bank in alerting regulators and exchange compliance teams allowed the perpetrators to launder upwards of $30 million (€26.6 million) that could otherwise have been frozen by law enforcement.
Exchanges Kraken and Crypto.com have said they restricted accounts or blocked funds linked to the incident, insisting their own systems were not compromised, according to French crypto outlet Cryptoast. ZachXBT said he was confident the attacker was not linked to North Korea’s Lazarus group.
In a public statement issued on November 4, Crédit Mutuel Arkéa acknowledged that it had been hit by an intrusion that facilitated fraudulent transfers, but insisted the breach was now contained.
“Crédit Mutuel Arkéa has been the target of an attack that enabled the execution of fraudulent transactions. The incident is now under control,” the group stated, stressing that the theft had “no financial impact” on retail clients and that customer deposits remained fully protected.
As a precautionary measure, the bank temporarily suspended certain transactions to prevent further illicit fund movements. It said these would resume quickly once final checks were complete.
While the lender declined to publicly confirm the total financial loss, the scale of the suspected theft represents one of the largest cyber heists ever recorded against a traditional French commercial bank. Arkéa has not said how the attackers gained access.
Beyond retail banking, Arkéa is an institutional pillar in European financial technology.
Through its subsidiary Arkéa Banking Services (ABS), the group provides white-label custody, payment rails and SEPA gateway infrastructure to major neobanks and fintech platforms, including several digital asset firms operating under the European Union’s Markets in Crypto-Assets (MiCA) framework, which has applied in full since December 30, 2024.
The breach also marks a major early test for the EU’s Digital Operational Resilience Act (DORA), the bloc’s cybersecurity rulebook for the financial sector, which entered into full application on January 17, 2025.
Under DORA’s reporting rules, financial entities operating in the bloc must classify major information and communications technology (ICT) incidents and submit an initial notification to national supervisors within four hours of classifying an incident as major and no later than 24 hours after detecting it.
According to the regional daily Le Télégramme, Arkéa has informed the Banque de France, which houses the Prudential Supervision and Resolution Authority (ACPR). The ACPR forwards notifications on significant institutions to the European Central Bank. The Banque de France declined to comment to AFP. Investigations by French cyber police and digital forensic teams are ongoing.
The intrusion lands amid a flurry of high-profile cyber breaches rattling French digital infrastructure and the wider financial sector.
It comes just days after the record $6.3 billion (€5.6 billion) Binance crypto heist on October 29, which the FBI has attributed to IT workers linked to North Korea.
In France, the banking breach also follows an aggressive wave of disruptive attacks targeting core domestic infrastructure.
On the night of October 11, a major cyber sabotage campaign against food retail logistics saw the refrigeration systems of hundreds of French supermarkets tampered with, forcing grocery chains to dispose of vast quantities of spoiled products after refrigeration controllers were remotely switched to defrost cycles. Prime Minister Sébastien Lecornu ordered the National Cybersecurity Agency of France (ANSSI) to investigate.
That incident in turn follows a relentless stream of public sector breaches, including the theft of nearly 700,000 taxpayer records from the French tax authority, disclosed in August, and a breach at the French Ministry of National Education in July that potentially exposed the records of staff employed since 2001.
🔴 Exclusif
Fraude chez Crédit Mutuel Arkéa (@cmarkea) : comment un réseau a vidé les comptes de sa banque en ligne @Fortuneo
En croisant le témoignage de nouvelles sources avec ce que montrent les analyses onchain, on peut désormais reconstituer, étape après étape, le chemin… https://t.co/2Cf6jrLTye
— Grégory Raymond (@gregory_raymond) November 4, 2026
