Crédit Mutuel Arkéa Heist: Up to $133M Moved Out via a Service Provider and Cashed Out as Stablecoins

French cooperative bank Crédit Mutuel Arkéa has confirmed that an attacker came in through a third-party service provider’s platform and used the bank’s own account to send transfers to other banks. The money was then converted into cryptocurrency. Blockchain investigator ZachXBT estimates the loss at up to $133 million (about €118 million), which left as the stablecoins USDC and USDT. The bank will confirm only the “order of magnitude”. For anyone who runs payment integrations, this case shows how a trusted supplier connection can become a direct route to the treasury.

What	Fraudulent interbank transfers from the bank’s proprietary account, converted to crypto
Victim	Crédit Mutuel Arkéa (France), a cooperative banking group with about €211.5bn in assets
When	Withdrawals began around 1 Nov 2026 and ran over several days, per ZachXBT. The bank disclosed on 4 Nov. BleepingComputer reported on 7 Nov.
Amount	Up to $133M / €118M (ZachXBT’s estimate). The bank says only that the “order of magnitude” is right.
Entry point	An unnamed third-party service provider’s platform. The bank says its Fortuneo subsidiary was not the entry point.
Cash-out	Withdrawn as USDC and USDT. More than $30M had been laundered by 3 Nov, per ZachXBT.
Customer impact	The bank reports no loss to customer assets, only delayed transfers and a temporary outage of its app and some services.
Attribution	None. No group has claimed the attack and the bank names no suspect.

What happened

Crédit Mutuel Arkéa is based in Brittany and includes the Crédit Mutuel de Bretagne and Crédit Mutuel du Sud-Ouest federations. It confirmed a cyberattack on 4 November. The group’s mobile app had been unavailable since that morning, and some transactions were suspended as a precaution. In an FAQ and in statements reported by French financial media, the bank gave the following account:

• Entry point. The attacker got in through the platform of a service provider and from there reached Arkéa directly. The bank says its online bank Fortuneo was not the entry point. It has not named the provider.
• Which account. The attacker used Arkéa’s own proprietary account, not accounts belonging to customers of its federations or subsidiaries, to send transfers to other banking institutions. The funds were then converted into cryptocurrency on specialised platforms.
• Cause. The bank rules out human error on its side. It describes a sophisticated external attack and says its security systems flagged the suspicious activity quickly.
• Status. The bank says the incident is closed and under control, that part of the funds has been blocked, and that recovery work is continuing. It is working with judicial and police authorities and says it has informed the relevant regulators and supervisors. It also says the sums involved do not threaten its solvency.

The bank has not published the figure. It told customers it “can only validate the order of magnitude” of ZachXBT’s €118 million estimate (BleepingComputer). It also warned customers to expect more phishing that uses the incident as a lure.

Timeline

• About 1 Nov: Unauthorised withdrawals from several centralised exchange accounts begin, per ZachXBT. He says the activity ran over several days.
• 2 Nov: ZachXBT posts a warning that an unnamed EU entity has lost more than $106M.
• 3 Nov: He traces another $27M in withdrawals, some made after his first post, which brings his estimate to more than $133M. He says over $30M has already been laundered. Late that day (US time) he names Crédit Mutuel Arkéa (The Block).
• 4 Nov: The bank confirms the attack, suspends some operations and takes its app offline. That evening it publishes a fuller account naming the service-provider entry point.
• 5 Nov: AFP reports that no group has claimed the attack and lists the main open questions.
• 7 Nov: BleepingComputer publishes its report. Its request to the bank for further detail had not been answered at publication.

Where the money went (per ZachXBT)

According to The Block’s summary of ZachXBT’s tracing, the attacker withdrew the funds as USDC and USDT and swapped some USDC for ETH. The funds were then moved through several instant-exchange services, part was converted to Monero (XMR) and part was bridged across several chains. ZachXBT said he has a “high degree of confidence” that North Korea’s Lazarus Group is not involved. He also argued that earlier disclosure to EU law enforcement could have led to some of the laundered funds being frozen. None of this tracing has been independently verified by the bank or by the authorities, and no wallet addresses have been published in the sources we reviewed.

How provider-path treasury attacks work (general context)

Context, not case detail. This section describes a recurring pattern in attacks on payment infrastructure. The bank has not explained how this intrusion worked, and nothing below should be read as a description of what happened at Arkéa.

Banks and fintechs connect many outside providers to their payment systems, including payment hubs, messaging gateways, treasury and liquidity platforms, managed-service operators and crypto on-ramp partners. These integrations often hold standing credentials, API keys or network routes that can originate payments, not just read data. In past cases at other institutions, attackers have typically followed a chain like this:

• Compromise the supplier, for example through stolen credentials, a vulnerable internet-facing service or a compromised operator workstation.
• Pivot over the trusted connection, such as a VPN, private link or API, into the bank’s environment, where traffic from the provider is often allowed by default.
• Act as a legitimate originator. Payment instructions submitted through an approved channel can pass format and sanction checks while bypassing the human approvals that apply to staff-initiated transfers.
• Target the institution’s own nostro or treasury accounts. These hold large balances and are not covered by customer-facing fraud models.
• Cash out quickly, now often by sending fiat to exchange accounts and withdrawing as stablecoins. These settle in minutes, can be swapped or bridged, and leave a narrow window for freezes by issuers and exchanges.

The Arkéa case matches the parts of this chain that the bank has confirmed: supplier entry, the bank’s own account, interbank transfers and conversion to crypto. Everything in between is still unknown.

What we still don’t know

• The provider, what it supplies, and whether it serves other banks. AFP raised the question of systemic risk.
• How the initial access and the pivot worked, including whether credentials, a software flaw or an API abuse was involved. No CVE has been linked.
• The exact amount lost, blocked and recovered. Only ZachXBT’s estimate exists.
• Who did it. There is no claim and no attribution. ZachXBT only rules out Lazarus, by his own assessment.
• Official statements. Neither a regulator nor a prosecutor has commented publicly in the coverage we found. French media report that the Banque de France was notified, but the bank has not confirmed that specifically.
• Why the conversion was not stopped earlier, given that the withdrawals reportedly ran over several days.

What to do now: defensive checklist for banks and fintechs

MAG212 recommendation. The checklist below is our own editorial guidance, built from the general pattern above. It does not come from Crédit Mutuel Arkéa, its provider or any regulator. Items are listed in priority order.

• 1. Inventory every path that can originate a payment. List each provider, API key, service account and network link that can create or release outbound transfers, especially from the institution’s own nostro and treasury accounts.
• 2. Require out-of-band approval for provider-originated treasury payments. No supplier credential should be able to move proprietary funds alone. Above a set threshold, require dual control by your own staff on a separate channel.
• 3. Set hard limits by channel. Apply per-transaction, daily and new-beneficiary caps to each integration, enforced in the core payment system rather than at the provider.
• 4. Alert on new beneficiaries and crypto on-ramps. Flag first-time counterparties, beneficiary banks known to serve exchanges, and bursts of high-value transfers outside normal treasury cycles.
• 5. Segment supplier connectivity. Terminate provider links in a dedicated zone, allow only the specific endpoints needed, and log and review every session. Remove any standing route from a provider into core banking.
• 6. Rotate and scope provider credentials. Use short-lived, least-privilege tokens bound to mTLS or IP allowlists. Revoke anything shared or long-lived.
• 7. Prepare a freeze playbook. Keep pre-agreed contacts at correspondent banks, major exchanges and stablecoin issuers, plus law-enforcement reporting channels, so that recall and freeze requests go out within hours.
• 8. Audit your suppliers’ security, not only their contracts. Ask providers with payment access for evidence of MFA, privileged-access controls and incident notification times. Test the integration in red-team exercises.

The detection logic below is an illustrative MAG212 example for a payments SIEM or transaction-monitoring engine. Adapt the field names to your own schema.

-- MAG212 example: provider-originated outbound transfers from own accounts
SELECT originating_channel, debit_account, beneficiary_bic,
       COUNT(*) AS n, SUM(amount_eur) AS total_eur
FROM payments_outbound
WHERE debit_account IN (SELECT account_id FROM treasury_accounts)
  AND originating_channel LIKE 'provider:%'
  AND created_at >= NOW() - INTERVAL '1 hour'
GROUP BY originating_channel, debit_account, beneficiary_bic
HAVING SUM(amount_eur) > 1000000
    OR beneficiary_bic NOT IN (SELECT bic FROM known_counterparties);

Related on MAG212 CYBER

• The Trusted Path: MAG212 CYBER Daily, November 8, 2026

Sources

• BleepingComputer: “Hackers pull off $133 million French bank heist via service provider” (Bill Toulas, 7 November 2026)
• The Block: “French bank Crédit Mutuel Arkéa exploited for over $133 million, ZachXBT says” (Danny Park, 3 November 2026)
• Boursier.com via Bourse Direct: “Banques : Crédit Mutuel Arkéa fait un nouveau point sur la cyberattaque” (4 November 2026)
• The Connexion: “French bank hit by cyberattack with €118m reportedly stolen” (Kyriaki Topalidou, 4 November 2026, updated 5 November)
• AFP via DH: “Crédit Mutuel Arkéa : les questions en suspens après la cyberattaque” (5 November 2026)

Written and edited by El Mostafa Ouchen for MAG212 CYBER. Facts verified against the sources above as of 8 November 2026.