What the bank has confirmed
Arkéa announced the attack itself on 4 November 2026. It says fraudulent operations took place, that customer assets are not affected, and that the incident is contained. In its FAQ, the bank said the attackers used its own account to send transfers to other banks. Those transfers may then have let them convert the money into cryptocurrency through specialised platforms. Because the money moved out of the bank's own account, the bank says no customer accounts were involved.
The bank also rejected press reports that the intrusion came through Fortuneo, its online bank. It said the attackers went through the platform of one of its service providers and so reached Crédit Mutuel Arkéa directly.
Customer impact, per the bank:
- It says there is no consequence for customer assets. The only effect was a delay in executing some transfers.
- As a precaution, it temporarily suspended certain transactions to secure operations and prevent more fraudulent movements.
- Almost all operations resumed on the morning of 4 November, after checks and reinforced security measures.
- It described a sophisticated external attack rather than human error. It says it is working with judicial and police authorities to establish the origin and method.
The $133 million figure is not confirmed
The $133 million number comes from blockchain investigator ZachXBT, who put it at €118 million. Arkéa was asked directly whether it confirmed that amount. Its answer was that it does not confirm the figure and can only validate the order of magnitude.
The bank also said:
- Part of the funds has been blocked, and other actions are under way to recover them.
- It is too early to give a final amount.
- The sums involved do not threaten its financial soundness.
Other reports differ. Cypro, a UK security firm, reported that around €100 million was reportedly missing by 5 November 2026, although the final loss remains unconfirmed. French outlet franceinfo summarized the bank's wording as a figure it can "simply validate" as an order of magnitude, meaning several tens of millions of euros. Treat the $133 million figure as an investigator's estimate and not as the bank's accounting.
The tracing claims
The Block reported that ZachXBT first flagged the activity on Nov. 2 and estimated losses above $133 million. He said the figure could rise because the attack unfolded over several days and may have involved over-the-counter transactions.
The Block also reported his description of how the funds moved:
- Swaps from USDC to ETH.
- Routing through instant exchanges such as WellWallet and Kyrrex.
- Conversion into Monero (XMR) via Wagyu.
- Bridging across multiple chains.
He also said he has a "high degree of confidence" that the attacker was not associated with North Korea's Lazarus Group. That is an investigator's opinion. I found no official attribution in the material reviewed.
BleepingComputer adds that ZachXBT said the lack of public disclosure let the attacker launder $30 million by November 3. He argued that EU law enforcement would otherwise have frozen those funds. That is his claim, and nobody has independently verified it. It does show why the gap between theft and disclosure matters.
The phishing warning
The bank urged customers to be vigilant about unsolicited messages. It also said to verify anything suspicious by calling the bank adviser directly. That is sensible advice. It does not mean customer data was stolen. Arkéa warned customers about phishing attempts that impersonate the bank. In its FAQ it said phishing attempts commonly rise after attacks of this kind, and that the warning was preventive. No customer-data breach has been confirmed.
What is still unknown
The bank has not identified the service provider, explained the technical access mechanism, or said whether compromised credentials, an application flaw or another method was used. Security firm Halborn frames the open question this way: how could an attacker with access through a service provider move transfers of this size from the bank's own account, and how long did it take to detect and stop them?
Nobody outside the investigation can answer that yet. Be wary of anyone who claims to know the root cause, whether stolen credentials, a software flaw or something else.
Why IT admins should care
This section is my own analysis from general industry practice. It is not a finding about Arkéa's systems.
The confirmed facts point to a familiar risk. A vendor platform with a trusted path into critical operations can be as dangerous as a direct breach of your own network. Questions for your own environment:
- Which third-party platforms can initiate or approve high-value actions, such as payments or admin changes?
- Are those permissions limited to what the vendor needs, and are they reviewed regularly?
- Is there independent approval or out-of-band confirmation for unusual high-value transactions?
- Do you monitor vendor-originated activity for anomalies, and can you suspend it quickly?
- Do your incident plans include early notification of exchanges, partner banks and law enforcement?
Arkéa says its security systems spotted the suspicious activity quickly and its crisis procedures were activated. Even so, ZachXBT's tracing suggests funds were already moving through exchanges before the bank named itself. The bank has not said how long the attackers had access. Detection speed and disclosure speed both affect how much can be frozen.
The bottom line
- The bank confirms an external attack that used a service provider's platform and its own account. It does not confirm a loss of $133 million.
- Customer assets are unaffected, according to the bank. Customer-data exposure is neither confirmed nor ruled out.
- The provider, the intrusion technique and the attacker are not publicly identified.
- The most useful takeaway for admins is to audit third-party access and the controls on high-value actions.