What happened
- French cooperative bank Crédit Mutuel Arkéa was targeted in a cyberattack enabling fraudulent transactions of up to $133 million, forcing it to suspend certain systems.
- The bank says the attacker used its own account to initiate transfers to other banks, and that members’ assets were unaffected.
- First signs came on 2 November 2026, when fraud investigator ZachXBT warned of a large unauthorized withdrawal across several exchange accounts the day before.
- According to the investigator, the attacker may have stolen up to €118 million and withdrawn it as USDC and USDT stablecoins.
- The bank disclosed the incident on 4 November and said it “is now closed and under control”, with operations gradually returning to normal.
Why it matters
The case shows how an attack on financial infrastructure ends in crypto. Once money becomes stablecoins and moves across exchanges, recovery requires someone to freeze funds fast. ZachXBT said the lack of public disclosure let about $30 million be laundered by 3 November, money European police could have frozen. The vector matters too: BleepingComputer’s headline says the heist ran through a service provider, a link many institutions share.
The number
$133 million. The maximum of fraudulent transactions, equal to €118 million, at a bank with over 5.8 million members and €211.5 billion in assets.
Context
The text read gives no technical detail of the attack and does not name the provider, so the exact chain of events is not publicly confirmed. Whether the bank recovered funds is also unknown. Arkéa’s statement that the incident is “closed” could not be independently checked. Related coverage: Chainalysis admits a breach exposed credentials and tokens for all its users, A new wave of cyberattacks hits Daishin, Mirae and Bithumb in South Korea, QNAP confirms attackers are breaking into its NAS devices with the Plex2Shell flaw chain, An oversized password opens no-password Linux accounts with OpenSSH and musl.
What’s next
- The bank or French authorities still have to identify the provider and those responsible.
- The investigation should clarify why public disclosure took two days.
- Exchanges involved could freeze funds if alerted in time.
Bottom line
When money moves in minutes, early notice is part of defense. Two days of silence were enough for part of the loot to leave police reach.
Sources
- BleepingComputer, “Hackers pull off $133 million French bank heist via service provider”, 7 November 2026; early alerts from investigator ZachXBT and Crédit Mutuel Arkéa’s statement as quoted by the outlet. The bank’s page was not read.
- Cover image: Baidax, CC BY-SA 4.0, via Wikimedia Commons
Edited by Rodrigo Cornejo. How we select and verify: who writes these notes.
