French banking group Crédit Mutuel Arkéa has disclosed further details of a cyberattack involving an amount estimated at approximately $133 million, saying attackers accessed its systems through a third-party service provider and may have moved some of the funds into cryptocurrency.

In an update published on November 4, the bank explained that the attackers exploited the platform of an external service provider to gain access to its systems. Once inside, they used an account belonging to the bank to transfer funds to other financial institutions. Intrusions routed through external providers are a recognized risk pattern for banks, which rely on a range of outside platforms and vendors for core operations, a dependency that can extend an institution's exposure beyond its own infrastructure.

The incident has drawn attention to the potential role of cryptocurrency platforms in the movement of the stolen money. According to information reported by Wu Blockchain, the transferred funds may subsequently have been converted into cryptocurrency through specialized platforms. The available details, however, do not establish how much money, if any, was ultimately converted into digital assets. That open question matters because funds that pass through such platforms can be harder to trace and recover, which is why observers frequently track whether stolen money reaches digital-asset services in incidents of this kind.

Bank Does Not Confirm Exact Amount

Reports have placed the sum involved at €118 million, equivalent to approximately $133 million. Crédit Mutuel Arkéa said it could not confirm the exact figure but acknowledged that the reported amount was of the correct order of magnitude.

The distinction is significant because the bank has not independently confirmed the precise financial impact of the attack. Its statement instead indicates that the widely reported market estimate is broadly consistent with the scale of the incident.

The bank also said that some of the affected funds had been blocked and that efforts to recover the money were continuing. Its statement did not specify how much had been frozen or how much could ultimately be recovered, figures that will be central to gauging the incident's final cost once the bank provides further updates.

Fortuneo and Customer Assets Not Affected

Crédit Mutuel Arkéa rejected reports suggesting that the attackers had entered its systems through Fortuneo, its online banking subsidiary. The bank emphasized that customer assets were not affected by the incident and that the external attack had been contained. That clarification narrows the entry-point question back to the third-party provider named in the bank's own account, keeping the focus on the external channel through which the breach occurred rather than the bank's customer-facing platforms.

While recovery efforts remain ongoing, the bank's disclosure separates the incident's reported financial scale from the confirmed status of customer funds and the containment of the breach. The main points still to be clarified are the confirmed loss figure, the amounts frozen and recovered, and whether any portion of the funds was actually converted into cryptocurrency.

The information was reported by Wu Blockchain, which cited the bank's November 4 disclosure. Crédit Mutuel Arkéa has acknowledged the approximate scale of the reported €118 million loss while declining to confirm an exact amount.