Crédit Mutuel Arkéa said on Wednesday that it was the victim of a cyberattack that enabled fraudulent operations. In a follow-up press release at 5:30 p.m. Paris time, the Brest-based cooperative bank filled in how the money moved — and what it will not confirm.

Attackers used Crédit Mutuel Arkéa's own account to send transfers to other banks, the bank said. Those funds may then have been converted into crypto through specialized platforms. The attackers did not go through customer accounts at its federations or subsidiaries. The bank said the incident has no financial consequence for clients. Some transfers were delayed while controls ran.

What the bank confirmed

An earlier communiqué dated Nov. 4 said the incident was contained, operations were restarting and customer assets were not hit. The afternoon FAQ sharpened that story:

  • Entry was not through Fortuneo, despite some press reports. Attackers came through a service provider's platform and reached Arkéa directly.
  • The bank called it a sophisticated external attack, not a human error inside Arkéa.
  • Security teams spotted suspicious activity quickly and froze further fraudulent moves. Supervisors were informed. Some transactions were paused as a precaution.
  • Asked whether €118 million ($133 million) was stolen, Arkéa said it does not confirm those figures and can only validate the order of magnitude. Some funds have been blocked. Recovery work continues. The bank said the amounts do not threaten its financial health.
  • Mentions of phishing in its first note were a customer warning about likely follow-on scams, not a claim that client data was breached.

Decrypt reported that onchain investigator ZachXBT had named Arkéa as the alleged victim of a theft of more than $133 million a day earlier. CoinDesk's coverage of that tracing said about $108.8 million in USDC left Kraken, Crypto.com and OKX accounts over roughly 21 hours. Arkéa's own releases do not adopt those exchange-level details or a final loss number. They also do not name the service provider whose platform was used as the entry point.

The bank said it is working with judicial and police authorities on the origin and method of the attack. It warned clients to expect phishing attempts that try to steal login details, card numbers or SMS codes, and told them to contact their own banker if a message looks off. That warning is separate from the fraud path itself. Arkéa said client data compromise is not what its phishing note was claiming.

We held a ZachXBT-only version of this story in yesterday's digest because there was no bank primary yet. Wednesday's two communiqués change that. The facts that now clear the bar are the bank's own: own-account misuse, no customer-account path, Fortuneo not the entry, order-of-magnitude validation without a locked total, and a claim that the hit does not threaten group solvency.