---
title: "Crédit Mutuel Arkéa: its own money, not customers’, left through a supplier’s platform"
summary: "What Crédit Mutuel Arkéa said on 4 November about funds moved from its own account through a supplier’s platform, and the US$133m crypto trail an investigator traced from 1 November."
url: https://www.thetechbag.com/blog/credit-mutuel-arkea-own-funds-supplier-platform
format: Note
desk: "Security"
area: "Threats & vulnerabilities"
region: Global
published: 2026-11-05
facts_checked: 2026-11-05
author: TechBag (The TechBag Journal)
tags: ["Crédit Mutuel Arkéa","France","bank cyberattack","third-party risk","supplier platform","Fortuneo","ZachXBT","stablecoins","USDT","USDC","crypto laundering","fund recovery"]
cover: https://www.thetechbag.com/blog/covers/credit-mutuel-arkea-own-funds-supplier-platform.png
---

# Crédit Mutuel Arkéa: its own money, not customers’, left through a supplier’s platform

*What Crédit Mutuel Arkéa said on 4 November about funds moved from its own account through a supplier’s platform, and the US$133m crypto trail an investigator traced from 1 November.*

Note · Security · Threats & vulnerabilities · By TechBag · Published 2026-11-05 · Facts checked 2026-11-05 · Canonical: https://www.thetechbag.com/blog/credit-mutuel-arkea-own-funds-supplier-platform

Crédit Mutuel Arkéa, the cooperative banking group based in Brest, says attackers used “Crédit Mutuel Arkéa’s own account”, not its customers’ accounts, to make transfers to other banks, which then “potentially allowed them to convert this money into cryptocurrency via specialised platforms”. They got in through “the platform of one of our service providers” and reached the bank directly (our translations).[2] Asked whether €118m (US$133m) was taken, the bank said it does not confirm the figure and “can simply validate the order of magnitude”.[2]

## What the bank has said, and what it has not

Its first statement, at 13:00 Paris time on 4 November, reported “an attack that enabled fraudulent operations to be carried out”. The group informed its supervisors, suspended some transactions as a precaution and was resuming operations through the morning; customers’ holdings were not affected, and some transfers were only delayed. The amounts were “still being assessed” and do not threaten the group’s solidity.[1] The follow-up added the detail: the bank’s own account was used; no “entry” was made through its online bank Fortuneo, as some press had written; it was not human error at Arkéa but “a sophisticated attack from outside, now contained”; and “part of the funds concerned could be blocked, and other actions are under way to recover them”.[2]

It has not named the provider, said what its platform does, given a date for the transfers or said how much was blocked. It is working with the judicial and police authorities on “the origin of the attack and its modus operandi”.[2]

TechBag countAgainst the balance sheet

Arkéa reports total assets of €211.5bn and more than 5.8 million members and customers.[1] €118m is about 0.06% of those assets (TechBag arithmetic on a figure the bank has not confirmed).

## From a bank transfer to crypto, as an investigator traced it

The figure traces to ZachXBT, an independent investigator who follows stolen funds on public blockchains. On 2 November he reported that an unnamed “EU entity” was suspected of losing more than US$106m from “multiple centralized exchange accounts” on 1 November, withdrawn as the stablecoins USDC and USDT. In the 24 hours before his post, he wrote, the funds were swapped for ether, sent to instant-exchange services, converted to Monero and bridged across blockchains.[3] On 4 November he raised the total to more than US$133m, some of it withdrawn after his first post, said the attack ran “for multiple days”, and named the institution as “allegedly” Crédit Mutuel Arkéa.[4]

**Figure: The crypto trail was public from 2 November; Arkéa confirmed an attack on 4 November**

*Statements by Crédit Mutuel Arkéa and posts by ZachXBT, 1 to 4 November 2026 (positions in UTC)*

| Date | Event | Detail |
| --- | --- | --- |
| 1 Nov 2026 | Exchange withdrawals, per ZachXBT | USDC and USDT taken out of several centralised-exchange accounts; a Sunday, and All Saints' Day in France |
| 2 Nov 2026 | ZachXBT: an EU entity, US$106m+ | Entity unnamed; funds being swapped to ether, sent to instant exchanges and converted to Monero |
| 4 Nov 2026 | ZachXBT: US$133m+, ‘allegedly’ Arkéa | The naming was added in a later edit to this post; 'the attack occurred for multiple days' |
| 4 Nov 2026 | Arkéa: an attack, transfers paused | 13:00 Paris release; customers' holdings unaffected; amounts still being assessed |
| 4 Nov 2026 | Arkéa: its own account, a supplier | Follow-up Q&A (hour not given): order of magnitude validated, part of the funds blocked |

Source: Crédit Mutuel Arkéa; ZachXBT (Telegram) · as of 5 November 2026, 13:30 UTC

Read together, the two accounts describe the path: money leaves the bank’s own account by ordinary transfer, lands at other institutions, funds exchange accounts and comes out as stablecoins. The link between ZachXBT’s wallets and Arkéa is his, and the bank has confirmed only the order of magnitude.

The stages matter for what can be clawed back. Stablecoins have issuers that can freeze them, as Tether and Circle did [after Binance’s theft](https://www.thetechbag.com/blog/binance-hot-wallet-theft-stablecoin-freeze); ether has no issuer, and Monero is built to hide where funds go. ZachXBT’s 1 November date was a Sunday and All Saints’ Day, a public holiday in France.[5] Arkéa has not said when the transfers left its account.

In India, CERT-In said on 4 November that [attackers calling NBFCs’ own payment APIs](https://www.thetechbag.com/blog/cert-in-crafty-falcon-nbfc-payment-attacks) time their transfers for weekends and holidays.[6] To watch: the final amount, the provider’s name and how much the freeze recovers.

How we did this

Figures as of 5 November 2026, 7pm IST (13:30 UTC)

The bank’s facts are its two statements of 4 November, read in French and translated by us. The US$106m and US$133m are ZachXBT’s on-chain tallies, not confirmed by the bank; the €118m is the euro figure put to the bank. The 0.06% is our arithmetic on that figure. Left out: press accounts of the entry route that the bank has denied, and other outlets’ asset totals, which differ from Arkéa’s own.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [Crédit Mutuel Arkéa, Le Crédit Mutuel Arkéa annonce avoir été victime d'une attaque (press release, in French)](https://www.cm-arkea.com/arkea/banque/upload/docs/application/pdf/2026-11/04112026_-_communique_-_le_credit_mutuel_arkea_annonce_avoir_ete_victime_dune_cyberattaque__2026-11-04_15-40-19_385.pdf) — 4 November 2026
2. [Crédit Mutuel Arkéa, Informations complémentaires suite à l'attaque dont le Crédit Mutuel Arkéa a été victime (in French)](https://www.cm-arkea.com/arkea/banque/assurances/pa_38386/fr/informations-complementaires-suite-a-l-attaque-dont-le-credit-mutuel-arkea-a-ete-victime) — 4 November 2026
3. [ZachXBT, Investigations by ZachXBT (Telegram), post 372: an EU entity suspected of losing US$106m+](https://t.me/investigations/372) — 2 November 2026
4. [ZachXBT, Investigations by ZachXBT (Telegram), post 375: total US$133m+, institution named (edited)](https://t.me/investigations/375) — 4 November 2026
5. [Service-Public.fr, Jours fériés et ponts dans le secteur privé (2026 dates)](https://www.service-public.gouv.fr/particuliers/vosdroits/F2405) — 1 January 2026
6. [CERT-In, CIAD-2026-0058: Escalation of AI-Driven Attacks on BFSI Entities by Threat Actor "CRAFTY FALCON"](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0058) — 4 November 2026

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

**Read this next:** [Amadeus breach hit at least ten airlines through one booking system](https://www.thetechbag.com/blog/amadeus-breach-airlines-one-supplier) — Another way in through a supplier: one booking system’s flaw exposed bookings at ten or more airlines, each counting the damage in its own unit.

Go deeper on TechBag

- [Privileged access management guide](https://www.thetechbag.com/browse/identity-access/privileged-access-management) — controls on the accounts and keys that can move a bank’s own money
- [Identity governance guide](https://www.thetechbag.com/browse/identity-access/identity-governance) — reviews of who, including a supplier, holds access to payment systems
- [SIEM and log management guide](https://www.thetechbag.com/browse/security/siem-log-management) — alerting on unusual transfers and access across a weekend