French co-operative bank Crédit Mutuel Arkéa said on Thursday that hackers stole around €100 million ($112.6 million) from the bank in a cyber heist, in a rare case of criminals successfully stealing money virtually from a mainstream European bank. The bank said it was working to recover the funds, and that no customers were affected. French prosecutors have opened an investigation.
The attack, which the bank made public on Wednesday, follows the theft last week of $6.3 billion in cryptocurrency from the exchange Binance. But where the Binance heist targeted a crypto platform, the Arkéa attack struck a regulated bank — something cybersecurity experts told Reuters and Le Monde they had not seen before at this scale in Europe.
What happened
According to Reuters, the attackers used an account belonging to Crédit Mutuel Arkéa to carry out what the bank described as "fraudulent transactions". The funds were not in the form of cryptocurrency when they were taken, the bank said, but could have been converted to crypto after being stolen.
Le Monde reported that the hackers compromised the computer of a third party that was authorised to carry out transactions on the bank's behalf, giving them deep access to its systems. They reached the bank's equity capital — about €10 billion — and siphoned off more than €100 million, a figure the bank said had not yet been finalised.
The stolen funds were then converted into cryptocurrencies and distributed across several exchange platforms, Le Monde reported. Among them was the American platform Kraken, which sounded the alarm on Monday after receiving unusually large transfers for a European bank and blocked the transactions in progress.
Arkéa temporarily suspended some transactions as a precaution, which caused delays to some transfers, but said customer assets were not affected. A spokesperson rejected media reports that its online banking subsidiary Fortuneo was the entry point for the attack, saying neither the division nor its customers' accounts were involved.
Scale of the loss: Arkéa, based in Brittany, has more than 5.8 million customers and €211.5 billion in assets, according to Reuters. The bank posts about €430 million in annual profits, so the theft represents roughly one quarter's net profit. For its parent company, Crédit Mutuel, the incident amounts to about 2.2% of annual results, Le Monde reported.
How the attackers got in
The bank has declined to identify the third-party service provider whose platform was used in the attack, Reuters reported. What is known is that the intruders did not need to break into the bank's own core systems directly: they exploited a trusted intermediary with the authority to move money, then used that access to push through fraudulent transfers.
That method closely resembled the attack on Binance on 29 October, Le Monde reported. In both cases, the attackers compromised a trusted party and moved quickly to convert stolen funds into cryptocurrency, where they can be scattered across exchanges and wallets.
Independent blockchain investigator ZachXBT, who specialises in tracking funds on the blockchain, was the first to spot the suspicious movements and money-laundering operations on Monday, Le Monde reported, before alerting his community on the social network Telegram.
Experts said the operation showed detailed knowledge of how banks move money. "One thing was certain: the amount stolen and the stealth of the operation demonstrated that it was a highly sophisticated attack, carried out with very detailed knowledge of banking procedures," Gabriel de Brosses, founder of the consulting firm Tevarua Conseil and former head of cybersecurity at Groupe La Poste, told Le Monde.
The investigation
The Paris prosecutor's office said its cybercrime unit received a complaint from Crédit Mutuel Arkéa on Wednesday and immediately opened an investigation, led by France's cybercrime police, Reuters reported.
The bank said it had informed the European Central Bank, French banking supervisors and prosecutors. France's banking regulator, the ACPR, declined to comment.
Who carried out the attack remains unknown. The Binance hack has been attributed by experts and US authorities to North Korea, which in recent years has become highly skilled at stealing digital assets, Le Monde reported — but it said it was too early to identify those responsible for the Arkéa heist. According to ZachXBT, the operation targeting the French bank did not originate from North Korea.
What is not yet confirmed: the exact amount stolen has not been finalised, and the attackers have not been identified. The newspaper Le Telegramme reported losses of $133 million, but the bank would not confirm that figure, Gulf News reported. Any claim about who carried out the attack is unconfirmed at this stage.
Why this heist is different
Cyberattacks on banks are common, but experts told Reuters it was unusual for money to actually be stolen virtually from a bank. Rafay Baloch, chief executive of the cybersecurity firm RedSecLabs, said the Crédit Mutuel attack was unprecedented in Europe.
"This is an attack of unprecedented scale and damage. Normally, this does not happen to banks."
— Gabriel de Brosses, founder of Tevarua Conseil and former head of cybersecurity at Groupe La Poste, to Le Monde
The banking sector has long been considered a leader in cybersecurity, in part because of strict regulation. "The banking sector is overseen by regulators who are extremely scrupulous and highly intrusive. Banks' level of maturity is very high," de Brosses told Le Monde, adding that the European Central Bank and the French prudential supervisor "are constantly conducting tests and audits".
That is what makes the scale of the theft so alarming to the sector: the controls that should have stopped it did not. "There is normally a whole array of mechanisms designed to prevent large, uncontrolled financial movements. Alarms should have sounded," de Brosses said.
A veteran of banking cybersecurity told Le Monde he was stunned. "This episode will send a wave of anxiety through every institution in the sector and will leave a mark. Bankers, more than any other industry leaders, hate risk," he said.
"Any time you have a hit in the financial system, it's a big deal," Puneet Kakkar, managing director at Nardello & Co in Paris, told Reuters. French banks typically have strong cybersecurity because of regulatory requirements, Kakkar said, but "cybercriminals are becoming more opportunistic and more creative".
A rare precedent
Successful hacks of large financial institutions are rare, but not unknown. In 2016, attackers stole $81 million from the Bangladesh central bank's account at the Federal Reserve Bank of New York, Reuters reported. Millions of dollars' worth of funds have also previously been stolen from banks in Russia and India during cyberattacks.
What sets the Arkéa case apart, experts said, is that it happened to a bank in one of the world's most heavily regulated financial systems — and that the attackers got away with a sum equal to a quarter of the bank's annual profit before the transfers were stopped.
Le Monde quoted a banker from the French sector who called the heist "a major wake-up call for the entire French and European financial sector. It proves that traditional banks are fully at risk."
| When | What happened |
|---|---|
| Monday 2 November | Kraken flags unusually large transfers from a European bank and blocks transactions in progress; investigator ZachXBT spots suspicious movements |
| Wednesday 4 November | Crédit Mutuel Arkéa says publicly it was the victim of a cyberattack; files a complaint with the Paris prosecutor's office, which opens an investigation |
| Thursday 5 November | Bank confirms hackers stole around €100 million and says it is working to recover the funds; customer assets unaffected |
What happens next
The investigation by France's cybercrime police is under way, and the bank says it is working to recover the stolen money — though it has not said how much has been frozen or clawed back. Some of the funds were blocked by exchanges after Kraken raised the alarm, but the full amount recovered is not yet known.
Regulators will also be asking how the attack succeeded. The European Central Bank and the French banking supervisor have been informed, and the case is likely to prompt fresh scrutiny of the third-party firms that banks rely on to move money — the weak link the attackers appear to have exploited.
For other European banks, the immediate question is whether their own controls would have caught transfers of this size. As de Brosses put it, the alarms should have sounded. Until the investigation explains why they did not, the sector will be reviewing its defences.
Frequently asked questions
Were Crédit Mutuel Arkéa customers affected?
No. The bank said customer assets were not affected and no customers were impacted by the attack. The bank itself is the sole victim. Some transfers were delayed after the bank temporarily suspended some transactions as a precaution.
Who carried out the attack?
That is not known. It is too early to attribute the attack, according to Le Monde. The independent investigator ZachXBT has said the operation did not originate from North Korea, despite similarities with the Binance hack, which experts and US authorities have attributed to North Korea.
Can the stolen money be recovered?
The bank says it is working to recover the funds, and some transfers were blocked by exchanges after Kraken raised the alarm. How much will be recovered is not yet known, and the final amount stolen has not been confirmed.
How does this compare with the Binance hack?
The Binance theft last week was far larger — $6.3 billion in cryptocurrency — but it targeted a crypto exchange. The Arkéa heist, at around €100 million, is much smaller in value yet more alarming to regulators and bankers, because it struck a regulated bank and exploited the trusted third parties banks use to move money.
What does this mean for other banks?
Experts say it is a wake-up call. Banks are among the most heavily regulated and best-defended institutions, yet the attackers moved €100 million before being stopped. Expect regulators to press banks on third-party access and on the controls meant to flag large, unusual transfers.
Key takeaways
- Hackers stole around €100 million ($112.6 million) from French bank Crédit Mutuel Arkéa, exploiting a third party authorised to carry out transactions.
- The funds were converted to cryptocurrency and spread across exchanges; Kraken flagged the transfers and blocked some in progress.
- No customers were affected — the bank, which earns about €430 million a year, absorbed a loss equal to roughly a quarter's profit.
- French prosecutors have opened an investigation; the attackers have not been identified and the final amount is not yet confirmed.
- Experts call it unprecedented for a European bank and a wake-up call for the sector's defences.
What to watch next: the French cybercrime police investigation, how much of the stolen money is recovered, whether the bank revises the €100 million figure, and what the European Central Bank and French regulators say about third-party access to bank payment systems.
