French cooperative bank Crédit Mutuel Arkéa said attackers accessed its systems through the platform of one of its service providers, rejecting reports that Fortuneo, the group’s online bank, was the entry point.

The bank provided the information in a question-and-answer statement released in Brest on November 4 at 5:30 p.m., following an earlier statement issued at 1:00 p.m. The release addressed questions about how the attack occurred and who was affected. The bank’s official statement is available here.

Crédit Mutuel Arkéa said the attackers used one of the bank’s own accounts to send money to other banks. The funds may then have been converted into cryptocurrency through specialized platforms.

Fortuneo Was Not the Entry Point

Some press reports had claimed that the attackers entered through Fortuneo. Crédit Mutuel Arkéa rejected that account, saying, “Despite what has been reported, there was no ‘entry’ through Fortuneo.”

Instead, the attackers used a service provider’s platform to reach Crédit Mutuel Arkéa directly, the bank said. It did not identify the provider. The bank also said that internal human error was not responsible for the incident, describing it as “a sophisticated attack from outside” that has since been contained. An intrusion routed through a vendor’s platform, rather than a bank’s own customer-facing systems, is the kind of third-party exposure European rules now explicitly address: the EU’s Digital Operational Resilience Act, in force since January 2025, requires financial institutions to manage risks from ICT service providers and to report major incidents to supervisors.

According to Crédit Mutuel Arkéa, the attackers did not use customer accounts at its federations or subsidiaries. The bank said the incident had no financial consequences for customers, although some transfers were delayed.

As a precaution, the group temporarily suspended certain transactions. Almost all operations resumed during the morning after checks were completed and additional security measures were implemented.

The group said it had notified the relevant authorities and supervisory bodies. Its teams are working with judicial and law enforcement authorities to determine the origin of the attack and how it was conducted.

The bank also warned customers about phishing. It said incidents of this type are often followed by an increase in phishing attempts designed to steal personal information and urged customers to remain vigilant.

The following post was published by Crypto Banter on X on November 4:

🚨FRENCH BANK ATTACK CONFIRMED: FORTUNEO HIT, $133M+ DRAINED INTO CRYPTO! New reporting confirms that @fortuneo , the online arm of Crédit Mutuel Arkéa, was targeted. Attackers issued transfers and moved the funds into crypto exchange accounts opened with forged identities.… pic.twitter.com/YemTytogpM — Crypto Banter (@crypto_banter) November 4, 2026

The post is available on X.

ZachXBT Tracks Funds Across Blockchains

ZachXBT, an independent on-chain investigator known for publicly tracing stolen cryptocurrency across exchanges and blockchains, first publicly flagged the exploit on November 2. He estimated that losses exceeded $133 million and said the amount could increase. He said the attack occurred over several days and may also have involved additional over-the-counter trades that could raise the total.

According to ZachXBT, the attacker exchanged USDC, a stablecoin pegged to the US dollar, for ETH and moved assets through instant exchanges including WellWallet and Kyrrex. Funds were also converted into Monero (XMR) through Wagyu and bridged across multiple blockchains. Instant exchanges let users swap one cryptocurrency for another quickly, often without the full identity checks required by larger platforms. Monero is built so that senders, recipients, and amounts are not visible on its public ledger, which makes tracing harder than on transparent blockchains such as Bitcoin or Ethereum.

ZachXBT said he had a “high degree of confidence” that North Korea’s Lazarus Group was not responsible for the attack. Crédit Mutuel Arkéa has not named any suspects.

The bank has 12,073 employees and more than 5.8 million members and customers. It reports total assets of €211.5 billion ($238.1 billion).

Asked whether €118 million ($133 million) had been stolen, Crédit Mutuel Arkéa declined to confirm the figure, saying it could validate only the order of magnitude. The bank said some of the funds had been blocked and that additional recovery efforts were underway.

It added that it was too early to provide a final amount, but said the losses were “in no way of a nature to undermine the financial strength and soundness” of the group. The identity of the service provider used to gain access, the precise final loss, and the outcome of the bank’s work with judicial and law enforcement authorities all remain unresolved.

Source: CoinCentral