French Bank Cyberattack: €100 Million Stolen via Service Provider

Crédit Mutuel Arkéa has confirmed that attackers drained roughly €100 million from its own corporate account. They entered through the platform of an external service provider, then issued fraudulent transfers to other banking institutions. The cyberattack on the French bank ended with the stolen money converted into cryptocurrency and withdrawn through exchange accounts. Customer deposits took no hit, and the Paris prosecutor’s cybercrime section opened an investigation on 4 November.

Inside the Account That Moved €100 Million

The attackers never touched individual customer accounts at any point in the operation. They worked their way into Arkéa’s internal network through a supplier’s platform, then used the group’s own proprietary account to move funds out. Money belonging to the institution left the building, not deposits held on behalf of members. For a cooperative group with 5.8 million members and €211.5 billion in assets, that distinction decides who carries the loss.

Arkéa has publicly ruled out two explanations that circulated after disclosure. Its online banking subsidiary Fortuneo was not the entry point, despite early reporting that pointed there. The group also rejected any suggestion of internal human error and called the intrusion sophisticated. The detail matters, because a cyberattack on a French bank normally starts with stolen customer credentials rather than supplier access.

Once the transfers landed, the funds moved into cryptocurrency through specialised platforms. On-chain tracing points to withdrawals in USDC and USDT stablecoins, with a meaningful share ending up in assets that no issuer can freeze. That conversion step makes a cyberattack on a French bank far harder to unwind. Transfers between regulated institutions can be reversed, but on-chain settlement cannot.

A French Bank Confirmed the Cyberattack Three Days After the First Withdrawals

The earliest suspicious withdrawals appeared on 1 November, well before any public statement. An independent blockchain investigator flagged them a day later, describing more than $106 million leaving centralised exchange accounts tied to an unnamed European entity. A further $27 million surfaced on 3 November, pushing the running estimate past $133 million. The same investigator named Arkéa overnight into 4 November, and the group published its first statement that afternoon.

Roughly $30 million had already passed through laundering channels by 3 November. Earlier disclosure would have given European law enforcement a chance to freeze it, so the three-day gap carried a measurable cost. Timing now works as an operational control for any French bank facing a cyberattack, not simply as a compliance box.

The Race to Freeze Stablecoins

Exchanges moved once the destination addresses entered the public record. Crypto.com blocked funds linked to the incident, OKX froze an institutional client account, and Kraken restricted accounts tied to the flows. Arkéa has since confirmed that part of the money is blocked and that recovery work continues.

The real cost of this cyberattack on a French bank depends on how much gets frozen in time. Arkéa’s provisional estimate of around €100 million already sits below the €118 million drawn from blockchain analysis, so the two figures may converge as the count firms up. The group says it can validate only the order of magnitude, not any precise number.

Why a Supplier Platform Became the Entry Point

Third-party platforms sit deep inside banking environments for sound operational reasons. They handle payments processing, reconciliation, reporting and customer servicing, and they do it at scale. They also hold credentials reaching into systems no bank would expose directly to the internet. An attacker who compromises one of those platforms inherits a trusted position without defeating the bank’s perimeter.

The route into this French bank ran through supplier infrastructure, and the cyberattack worked because that trust held all the way to the payment instruction. Nothing had to be forged along the way. The transfers carried valid authorisation and looked legitimate to every system they crossed. Fraud controls tuned for account takeover had nothing obvious to catch.

What Banks and Their Suppliers Should Check

Supplier access deserves the same scrutiny as employee access, and few organisations treat it that way. Time-bound credentials, mandatory multi-factor authentication on every external connection, and segmentation between supplier platforms and payment systems all shrink the blast radius. Logging that survives the vendor relationship matters too, because investigators need it months later. Every French bank reviewing its exposure after this cyberattack should start with the supplier register.

Transaction monitoring deserves equal attention alongside access control, and this case is a clear example. Anomaly detection on a bank’s own proprietary account, and not only on customer accounts, would have narrowed the window for this money to move. However, most monitoring programmes point outward at customer fraud, which leaves the treasury side comparatively unwatched.

Customers Face Phishing Rather Than Direct Losses

Arkéa’s banking app went offline for several hours and some transfers executed late. Still, no member lost money in the process. The group has warned customers to expect phishing attempts trading on publicity around the incident. Criminals track coverage of any cyberattack on a French bank and then send messages borrowing the institution’s name, urgency and branding.

Anyone contacted about the incident should verify the message by calling their adviser on a known number. Unsolicited requests for card details, passwords or security codes deserve no response at all. That rule holds regardless of how convincing the sender looks.

What Happens Next

France’s specialist cybercrime police are running the investigation under the Paris prosecutor’s cybercrime section. Prosecutors have qualified the case as an organised-gang attack on an automated data processing system. So far, no arrests have followed. Nobody has named the compromised service provider, and no researcher has attributed the operation to a known criminal group.

Arkéa restored nearly all operations within a day of disclosure and continues to assess the financial consequences. The compromised supplier platform remains the central open question in this cyberattack on a French bank. Its identity determines how many other institutions share the same exposure.

A French bank lost a nine-figure sum to a cyberattack without a single customer record leaving the building. That profile will repeat elsewhere, because the economics favour it. Treasury operations, supplier platforms and the payment rails between them now carry the risk weighting that customer databases have carried for a decade. The institutions that catch the next attempt will be the ones watching their own accounts as closely as they watch everybody else’s.