The Arkéa cyber heist has been confirmed by Crédit Mutuel Arkéa after attackers used an unnamed supplier’s platform to move money from the French cooperative’s own account, The Record reported. A bank statement said other institutions then potentially allowed conversion into cryptocurrency. Customer accounts were not accessed, the bank says the incident is contained, and the Paris prosecutor’s cybercrime section has opened an investigation.
Key Takeaways
- Attackers reached Arkéa through a supplier platform, not through Fortuneo.
- Transfers left the bank’s own account; customer assets were not touched.
- The bank validated the loss scale but has not published a final figure.
- Paris prosecutors opened an organized cybercrime inquiry and assigned it to Ofac.
How the Arkéa Cyber Heist Used a Supplier Platform
ZachXBT, a pseudonymous blockchain investigator, reported the theft on Monday, later named Arkéa, and said it ran for several days. The Record said he estimated the theft at more than $133 million, based on withdrawals from cryptocurrency exchange accounts and transactions intending to launder the assets. The bank confirmed a sophisticated external attack on Wednesday, 4 November, and said it was not the result of human error. Franceinfo noted that Arkéa belongs to the Crédit Mutuel confederation but keeps wide independence from the central body.
Arkéa said attackers had “gone through the platform of one of our service providers” and reached the group directly. It rejected reports that Fortuneo, its online banking subsidiary, was the entry. Franceinfo quoted the bank: “aucune ‘entrée’ ne s’est faite par Fortuneo.” The supplier was not named.
The statement carried by The Record said: “The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking institutions, which then potentially allowed them to convert this money into cryptocurrency via specialised platforms.” Franceinfo reported that the money was then transferred and converted on crypto exchange platforms before being split across a growing number of crypto wallets.
Loss Estimates the Bank Will Not Lock In
Franceinfo said specialists put the theft at €118 million ($133 million). In a later statement on Wednesday, the bank said “Nous ne confirmons pas ces informations,” Franceinfo reported, while The Record reported the bank could “validate the order of magnitude.” Cybernews reported that the bank put losses below the $133 million figure carried by CoinDesk. A spokesperson said: “It is still too early to give a final figure.”
The bank said some funds have been blocked and that recovery continues. The sum, it said, was “absolutely not of a nature” to threaten its solvency or financial health. Published asset totals do not match across outlets; the table keeps each figure with its source.
| Measure | Figure in sources | Where reported |
|---|---|---|
| Specialist estimate | €118 million ($133 million); ZachXBT estimated more than $133 million | Franceinfo; The Record |
| Bank position on the figure | Would not confirm it; order of magnitude only; no final amount | Franceinfo |
| Losses versus $133 million | Lower than $133 million; no final figure | Cybernews |
| First-half net profit | €230 million | Franceinfo, half-year report |
| Clients and assets | 5.8 million clients; €211.5 billion ($238 billion) | Cybernews |
| Annual-report assets | Above £237 billion | The Record |
Containment, Exchanges, and the Ofac Inquiry
“As soon as the attack was detected, the necessary measures were taken under existing crisis procedures. The incident is now under control,” the bank said in a press statement carried by The Record. Franceinfo reported that nearly all transfers resumed Wednesday morning after extra checks, with only some wires delayed, and that supervisors were notified under usual procedures.
Crypto platforms joined the freeze. Franceinfo, citing Cointelegraph, reported that Kraken restricted suspect accounts and was working with authorities on recovery, and that Crypto.com acted to stop associated funds from passing through. Arkéa said some converted assets are frozen and that it is working to recover the rest.
The public ministry told AFP, Franceinfo reported, that the Paris cybercrime section received Arkéa’s complaint on Wednesday morning and immediately opened an inquiry. The investigation covers “atteinte à un système de traitement automatisé de données en bande organisée” and was assigned to the Office anticybercriminalité (Ofac).
What Security Teams Should Test Next
Gabriel de Brosses, head of Tevarua Conseil, told Le Monde that alerts should have sounded and that the attackers had a “très bonne connaissance des procédures bancaires,” Franceinfo reported. He also said, “Normalement, cela n’arrive pas aux banques.” That is commentary, not a prosecutorial finding.
For CISOs and treasury leads, the confirmed path suggests four checks. These are control questions, not facts Arkéa has added:
- Find every supplier platform that can move the bank’s own funds.
- Apply dual control and velocity limits on those wires, not only retail payments.
- Plan for exchange freezes; Kraken and Crypto.com have already restricted suspect flows.
- Warn clients about bank-impersonation phishing, as Arkéa did, even though the bank has not mentioned data theft.
Cybernews noted other recent hits, including a reported $6.3 billion Binance theft, attacks on internet-connected fridges in Europe, and an overnight cyberattack on three French regional blood banks. Methods differ. The enterprise overlap is supplier platforms and systems that move value quickly, a pattern also visible in the Malaysia Airlines alert after the Amadeus breach and the Binance hot-wallet theft.
Arkéa has not named the supplier or said whether data was taken. The gap to test is the path it has already described: supplier platform, own account, other banks, and venues that may convert funds.
