Crédit Mutuel Arkéa: hackers stole ~$133M via compromised supplier account transfers
Severity: high · Patch status: no-fix-needed · Since 2026-11-02
French banking group Crédit Mutuel Arkéa confirmed a sophisticated cyber heist in which attackers, after compromising an unnamed third-party service provider, gained direct access to the bank's own account and initiated transfers to other banking institutions, then converted funds to cryptocurrency via specialised platforms. Blockchain investigator ZachXBT first reported the incident on 2026-11-02, estimating losses above $133 million from exchange withdrawals and laundering transactions; the bank validated the order of magnitude but not the exact figure. The bank disputed reports that its Fortuneo online banking subsidiary was the entry point, stressed customer accounts were not accessed, said some converted assets have been frozen, and stated the loss does not threaten solvency. Investigation with judicial and police authorities is ongoing; recovery efforts continue.
What to do
- Review and harden third-party/supplier access paths into core banking systems, including privileged account controls and network segmentation
- Monitor high-value transfer channels for anomalous transactions and enforce out-of-band verification for large transfers
- Assess exposure to any crypto-conversion laundering flows via exchange platforms and work with exchanges to freeze assets
- Coordinate with law enforcement and financial authorities on incident response and recovery
- Review supplier security requirements and incident-response crisis procedures
Sources
All live incidents on Threat Watch
