614/69 Friday, November 9, 2026
Crédit Mutuel Arkéa, a major banking and insurance group in France, disclosed a cyberattack on November 4, 2026, after attackers were found to have carried out unauthorized financial transactions through the bank’s accounts. Reports indicate that the attackers exploited systems belonging to a third-party service provider to gain access to transaction channels and transfer funds to other financial institutions, forcing the bank to temporarily suspend some systems while containing the incident. Reuters reported that the losses were estimated at approximately EUR 100 million, or around USD 112.6 million. However, Crédit Mutuel Arkéa stated that customer assets were not affected, although some money transfers experienced delays while systems were being investigated and restored.
Blockchain analyst ZachXBT reported observing unauthorized withdrawals from accounts on several cryptocurrency trading platforms and estimated that the attackers may have stolen as much as EUR 118 million, or approximately USD 133 million. The stolen funds were reportedly converted into stablecoins, including USDC and USDT, before being laundered through exchanges into Ethereum (ETH) and Monero (XMR), as well as transferred across multiple blockchain networks to obscure the transaction trail. ZachXBT stated that approximately USD 30 million had already entered the laundering process by November 3, 2026, and assessed from the movement of the assets that the attackers were unlikely to be associated with the Lazarus Group. Crédit Mutuel Arkéa has not confirmed the EUR 118 million figure reported by the analyst, acknowledging only that the losses were broadly in line with published estimates and that some of the funds associated with the incident had been frozen.
Crédit Mutuel Arkéa stated that after detecting the attack, it implemented containment measures, notified relevant regulators, and coordinated with law enforcement authorities to investigate the incident. The Paris prosecutor’s office has opened an investigation together with French cybercrime police to identify the attackers and determine how the systems were accessed. The bank confirmed that the incident has been contained and that services were gradually restored after systems were reviewed and additional security measures were implemented. Crédit Mutuel Arkéa described the attack as sophisticated and stated that it was not caused by an error by internal personnel. The bank also warned customers to remain alert for phishing attempts that may exploit the incident to impersonate the bank and steal sensitive information, while emphasizing that its financial position remains stable. Efforts to trace the stolen funds and identify those responsible remain ongoing.