Up to $133 Million Left Crédit Mutuel Arkéa Through a Service Provider's Platform. The Bank Confirms Only the Order of Magnitude, and Customer Accounts Were Not the Route.
If you run a bank or a payments team, the question this week is which outside provider has a session that can move money from your own accounts, and what limits sit on it. BleepingComputer reported on November 7, 2026 that attackers stole up to $133 million from Crédit Mutuel Arkéa, a French cooperative bank with more than 5.8 million members and 211.5 billion euros in assets, by getting in through a service provider's platform. Every figure below is reported, and the bank has confirmed none of the amounts.
What is reported
ZachXBT, the blockchain investigator who raised the alarm first, estimated the theft at up to 118 million euros, about $133 million. The bank's reply, as BleepingComputer quotes it: "We do not confirm this information and can only validate the order of magnitude."
The attacker reached the bank's network directly through the service provider's platform. BleepingComputer does not name the provider and does not say it was at fault. The bank ruled out human error on its side and called the incident a "sophisticated attack."
The theft did not go through customer accounts. The attacker used Arkéa's own account to send transactions to other banking institutions and convert the funds to cryptocurrency. ZachXBT says the money came out as USDC and USDT stablecoins from multiple centralized exchange accounts, and that $30 million had been laundered by November 3.
The bank says customer assets were unaffected and that the incident "merely resulted in a delay in the execution of certain transfer transactions." It suspended certain systems and says operations are returning to normal. It acknowledged that "some funds were blocked" without giving an amount. It is working with judicial authorities and police and warned customers to expect phishing, advising them to call their adviser directly to verify any unsolicited message.
The timeline
Reports surfaced on November 2, starting with ZachXBT, who described withdrawals a day earlier. The bank disclosed the incident on November 4. ZachXBT argues the gap let the attacker launder funds that EU law enforcement "would otherwise have frozen." That is one analyst's claim about speed, and we have no way to test it.
What is not known
BleepingComputer's article leaves a lot open. The provider is unnamed. The technique, malware, vulnerability and credentials involved are not stated, nor whether the transfers rode SWIFT or another payment rail. The attacker is not identified. The receiving banks, exchanges and blockchain addresses are not given. The confirmed loss, the amount blocked and the amount recovered are unknown, as is the exact date of the intrusion. The article says the bank had not responded to its request for comment as of publication.
What to check this week
These are our suggestions drawn from the pattern, not findings from the reports.
- Write down every provider that has any path into your payment or treasury systems, including support and managed-service logins, and who at the provider can use it.
- Alert on outbound transfers from your own accounts the way you alert on customer fraud. In this account of the incident, the bank's own account was the source.
- Put a limit and a second approval on what a provider-originated session can send, so one stolen session cannot move eight or nine figures.
- Know now whom you would call at an exchange or a stablecoin issuer to ask for a freeze. Hours matter, and the reported laundering happened in the first days.
Indicators
None were published, so nothing was added to the feed.
Limits
We read BleepingComputer's report of ZachXBT's estimate and the bank's statement. We did not read the bank's own notice or ZachXBT's original post, and we cannot confirm any amount.
Five percent of this is wrong somewhere. It always is. The provider's name and the actual technique will change the lessons here.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.