What happened
On November 4, 2026, Crédit Mutuel Arkéa, a French banking group based in Brest, confirmed it had been hit by a cyberattack that allowed fraudulent transactions.
I have been watching hacks since 2017. Most of them hit exchanges, bridges or DeFi protocols. This one is different: a traditional bank lost money, and part of that money appears to have moved into crypto.
What is confirmed
These points come from the bank's own statement and FAQ, AFP and the Paris prosecutor's office.
- A sophisticated external attack. Arkéa says it was not human error on its side.
- The bank's own account was used. The attackers sent transfers from Arkéa's own account to other banks. According to the bank, that money was then potentially converted into crypto through specialised platforms.
- Clients were not hit. No client accounts were used, and the bank says there is no financial impact on client assets.
- The incident is contained. Almost all operations resumed on the morning of November 4.
- Fortuneo was not the entry point. Arkéa officially denies it. The attackers reportedly went through the platform of one of the bank's service providers.
- The amount is around €100M. AFP reports a provisional estimate of about €100M. The bank validates the order of magnitude but does not confirm an exact figure. Part of the funds may have been blocked.
- A criminal investigation is open. The Paris prosecutor's cybercrime section opened an investigation and handed the case to OFAC, the French anti-cybercrime office.
No arrests have been announced so far.
What is reported but unconfirmed
- About $133M (roughly €118M), according to on-chain investigator ZachXBT and Le Télégramme.
- "At least €150M", according to Le Figaro.
- The crypto route. Funds may have gone through Kraken, Crypto.com and OKX, then into stablecoins and ETH.
- Freezes. Tether reportedly froze about $1.14M in USDT linked to the flows.
- Who did it. ZachXBT said he is highly confident this was not North Korea's Lazarus group.
The bank has confirmed none of these points. Figures may change as the investigation goes on.
What it means for crypto users
1. Whoever holds the keys carries the risk
Here, the bank held the keys and the bank took the hit. On an exchange, the platform holds your keys. In self custody, you do. Keep only trading funds on exchanges and store the rest with care.
2. On chain, money leaves a trail
Investigators reportedly started tracking these flows within hours, and some funds may have been frozen. That does not mean everything gets recovered, but transparency gives exchanges a real chance to act fast.
3. Watch out for phishing
After a big headline, scammers move in. Arkéa itself warns that phishing attempts are possible.
- Never share your login, password, card number or SMS code.
- Never share a seed phrase. No bank, exchange or support agent will ever ask for it.
- If in doubt, contact your bank or platform through its official app or website.
Want my daily market read?
Free Telegram Hub: daily levels, news decoded and my market view.
Sources
Educational only, NFA.
