French Bank Crédit Mutuel Arkéa Loses Around €100 Million in Sophisticated Cyberattack
Crédit Mutuel Arkéa has revealed that it lost around €100 million, roughly $112 million, after cybercriminals used a compromised external service provider to break into its systems and trigger a wave of fraudulent instant payments.
The Brittany-based banking and insurance group, which operates Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest, and the online bank Fortuneo, disclosed the cyberattack on November 4. Its chairman, Julien Carmona, later described the incident as “a heist of a new kind,” calling it unprecedented in its level of sophistication.
Despite the size of the loss, the bank says its financial stability is not at risk. Carmona explained that the amount represents about 1% of the group’s equity, or roughly one quarter of its earnings. He also emphasized that the attack targeted the bank’s own account, not customer accounts.
The cyberattack began outside the bank’s direct infrastructure. On October 27, Crédit Mutuel Arkéa detected signs that one of its service providers had been compromised. The bank immediately cut the connection with that provider and alerted authorities.
At that stage, however, the bank said it had no indication that data or access elements had already been taken from the third party and could be used to enter Crédit Mutuel Arkéa’s own systems. The service provider has not been publicly named. According to Carmona, the decision not to identify it was made collectively by banks, as naming the provider could expose similar companies to further attacks.
Once the attackers gained access, they allegedly created fake Fortuneo IBANs and used them to generate payment orders from Crédit Mutuel Arkéa’s own account to external accounts. The fraudulent transfers were carried out through instant payment systems, which Carmona noted generally involve fewer checks than traditional bank transfers.
The payments began on Sunday, November 1. According to the bank, the attackers carefully designed the operation to bypass controls and make the illegitimate transactions appear authentic. The funds were sent to real accounts held at legitimate European banks, accounts that the fraudsters had apparently opened themselves in advance.
This detail has raised concerns that the operation was planned long before the actual theft took place. After reaching those bank accounts, the money was moved toward cryptocurrency platforms in an apparent attempt to hide its origin and make recovery more difficult.
Crédit Mutuel Arkéa discovered the full scale of the fraud on the morning of Tuesday, November 3. In response, the bank cut off all external access to its information system and disconnected from the interbank payment network to prevent further losses.
The bank also removed the fake accounts, replaced authentication credentials, and publicly confirmed the attack the following day. Carmona said Fortuneo’s systems were not affected, meaning Fortuneo customers were not directly impacted by the incident.
Suspicious cryptocurrency activity was reportedly spotted before the bank publicly announced the breach. Carmona acknowledged that crypto-asset specialists had seen abnormal transactions heading toward cryptocurrency platforms on Sunday and Monday. However, he said that, at the time, no clear connection had been made to Crédit Mutuel Arkéa.
Blockchain investigators later identified large suspicious movements of funds. On-chain researcher ZachXBT flagged more than $106 million in suspicious withdrawals on November 2, later increasing the estimate to more than $133 million. The bank was publicly linked to the activity on November 4.
Blockchain analytics firm Bitquery traced about $108.8 million in USDC withdrawn from accounts at several major cryptocurrency platforms over a 21-hour period on November 1 and 2. Much of that money was reportedly converted into ether, a cryptocurrency that cannot be frozen by a central issuer in the same way as certain stablecoins.
Some platforms said they had taken action. Crypto.com stated that it blocked funds connected to the incident, while OKX said it froze an institutional customer account. Investigators have not publicly identified the group behind the attack, and ZachXBT said there was a high degree of confidence that North Korea’s Lazarus Group was not responsible.
Crédit Mutuel Arkéa has not yet released a final loss figure because efforts are still underway to recover part of the stolen money. Carmona said some transfers were held or frozen by banks and cryptocurrency platforms, and that a portion of the funds has already been recovered. Discussions are continuing over the remaining amount.
The bank is also speaking with its insurer as it assesses the financial impact of the attack. Meanwhile, the Paris prosecutor’s cybercrime unit has opened an investigation following the complaint filed by the bank on November 4.
One of the most striking claims surrounding the incident is the possible use of artificial intelligence. Carmona described the attackers as a highly organized and well-equipped criminal group and said the operation was “very likely” assisted by advanced AI.
However, the bank has not provided technical details explaining exactly how AI may have been used. Based on the information disclosed so far, the core methods involved in the attack are familiar in modern cybercrime: compromising a supplier, stealing access, creating fraudulent payment orders, using mule accounts, and laundering funds through cryptocurrency.
AI could potentially have helped with reconnaissance, coding, social engineering, document forgery, or account creation. But for now, the AI element remains an unproven claim rather than a confirmed technical finding.
The attack highlights a growing cybersecurity risk for banks and financial institutions: third-party providers can become a weak point even when a bank’s own systems are heavily protected. It also shows how instant payments, while convenient and fast, can create serious challenges when criminals manage to exploit them.
For Crédit Mutuel Arkéa, the incident is a major financial crime, but not an existential threat. For the wider banking sector, it is a warning that cybercriminals are becoming more patient, better prepared, and increasingly capable of blending traditional banking fraud with cryptocurrency laundering techniques.
