Crédit Mutuel Arkéa, a cooperative banking group with more than 5.8 million members and €211.5 billion in assets, disclosed on November 4 an attack that forced it to suspend some systems. According to the bank, the attacker reached its network through a service provider's platform, not through its online bank Fortuneo, and used Arkéa's own account, not customer accounts, to make the transfers.
The first reports came on November 2 from fraud investigator ZachXBT, who warned of a large withdrawal from several crypto exchange accounts a day earlier. He said up to €118 million was stolen and withdrawn as the USDC and USDT stablecoins, and that the lack of public disclosure let the attacker launder $30 million by November 3. The bank did not confirm the amount, but said it could "validate the order of magnitude" and that some funds were blocked.
The bank says the incident is "closed and under control," customer assets are unaffected, and it only delayed some transfers. Arkéa ruled out human error, described the attack as "sophisticated," and is working with judicial authorities and police to establish its origin. It warned customers of follow-on phishing: do not share sensitive details by phone or email, and verify any suspicious contact directly with a bank adviser.