Hackers Steal Around €100 Million in Raid on French Bank Crédit Mutuel Arkéa

French lender Crédit Mutuel Arkéa has said hackers stole around €100 million (about $112.6 million) in a cyber heist, in a rare case of criminals successfully taking money directly from a mainstream bank.

The bank disclosed the attack on Wednesday, 4 November, and confirmed the scale of the loss on Thursday, 5 November. French prosecutors have opened a criminal investigation, and the bank says it is working to recover the money.

How the heist unfolded

According to the bank, the attackers used an account belonging to Crédit Mutuel Arkéa itself to carry out a series of “fraudulent transactions”. The transactions were routed through the platform of a third-party service provider, the bank said, declining to name the company involved.

The stolen funds were not in cryptocurrency when they were taken, the bank said, although it acknowledged they could have been converted into crypto afterwards. The bank has not said precisely when the transactions took place, only that the attack was made public on Wednesday.

It is an unusually direct kind of bank robbery. Most cyberattacks on lenders target customer data or hold systems to ransom. In this case, Reuters reported, the criminals appear to have moved the bank’s own money out through its own payment channels.

Investigation under way

The Paris prosecutor’s office said its cybercrime unit received a complaint from the bank on Wednesday and immediately opened an investigation, led by France’s cybercrime police.

The bank said it had informed the European Central Bank, French banking supervisors and prosecutors about the incident. France’s banking regulator, the ACPR, declined to comment. No arrests have been announced, and the bank has not named any suspects.

Investigators will be looking first at the third-party platform the attackers used. Banks increasingly rely on outside firms to process payments, and a weakness in one of those links can expose the whole chain. The bank has declined to identify the provider, and it is not clear whether the attackers breached the provider, the bank, or both.

Customers unaffected, but transfers delayed

Arkéa said customer assets were not affected by the attack, and that the losses fell on the bank’s own accounts. As a precaution, it temporarily suspended some transactions, which caused delays to some transfers.

The bank also rejected media reports that its online banking subsidiary, Fortuneo, was the entry point for the attack, saying neither the division nor its customers’ accounts were involved.

Part of the stolen funds have been blocked as recovery efforts continue, according to AFP reporting. Freezing money that has already left a bank is a race against time, and investigators will be tracing where the transfers went and whether any of the cash has already been cashed out.

The total is still disputed

The exact sum taken remains unsettled. Reuters reported the figure at around €100 million, while blockchain investigator ZachXBT, who first raised the alarm about the incident on 2 November, has traced withdrawals totalling more than $133 million (about €118 million).

The bank itself has declined to state a precise amount to some outlets. The gap between the two estimates underlines how murky the early hours of a major bank heist can be, even when the victim is a regulated lender, and the final figure may move again as tracing continues.

A bad week for cybercrime

The Arkéa heist follows the $6.3 billion theft from Binance last week, the largest crypto theft on record, which US authorities have linked to North Korean hackers. The back-to-back incidents have renewed questions about how well financial firms vet the third-party platforms that move their money, and about how quickly stolen funds can be laundered through crypto.

The heist also lands amid a wave of consolidation in cybersecurity, as large vendors race to cover new attack surfaces. And it is the second banking crisis to shake a national lender in as many days, after the Ueno Bank collapse in Paraguay forced its president to resign.

For Arkéa, the immediate task is recovery: tracing the money, working with police and regulators, and reassuring customers that their accounts were never touched. For the wider industry, the episode is a reminder that the most valuable target in a cyberattack is not always customer data. Sometimes it is the bank itself.