French banking group Crédit Mutuel Arkéa has revealed on November 4 that hackers used its own account to make fraudulent transfers in a cyberattack involving a reported €118 million ($133 million), with some funds potentially converted into cryptocurrency.

The lender said attackers entered through a third-party service provider’s platform before gaining access to the bank, in a statement. They transferred money to other financial institutions, where it may subsequently have been converted into cryptocurrency.

Meanwhile, the bank acknowledged that the reported loss was within the correct range but declined to confirm the exact amount. Some funds have been blocked, while efforts to recover the remaining money are continuing.

Crédit Mutuel Arkéa says attackers used a third-party platform

The unauthorized transfers originated from an account belonging to Crédit Mutuel Arkéa itself, not from accounts held by its customers.

The company rejected reports that the attackers entered through Fortuneo, its online banking subsidiary. Instead, the hackers accessed the platform of an unnamed service provider and used it to reach the banking group directly.

Although the bank identified the entry point, it did not disclose the provider’s identity or explain which security weaknesses allowed the attackers to enter.

The lender denied suggestions that an employee’s mistake caused the incident, describing it as a “sophisticated attack from outside” that its security teams subsequently contained.

Following the discovery of suspicious activity, staff activated emergency measures to prevent further unauthorized transfers. Certain banking transactions were temporarily suspended while the group examined its systems and strengthened security controls.

In its initial announcement, the bank said services were gradually resuming on November 4. A subsequent update confirmed that almost all operations had resumed that morning after additional checks.

Customers experienced delays in some transfers, but the bank maintained that their assets were unaffected.

French bank has not confirmed the reported $133 million loss

Reports that approximately €118 million had been stolen prompted questions about the financial consequences of the attack.

When asked to confirm the figure, the group responded, “We do not confirm this information and can only validate the order of magnitude.”

The statement leaves the final loss uncertain because investigators are still determining how much money was transferred and how much can be recovered.

According to the lender, part of the affected funds has already been blocked, although it did not identify the financial institutions involved or disclose the amount secured.

Other recovery measures remain underway as the group works to establish the full financial consequences.

The bank said the incident would not undermine its financial position. Its published corporate figures show total assets of €211.5 billion, although the final financial loss has not been established.

The company notified the relevant supervisory and law-enforcement authorities after discovering the attack.

AFP separately reported that the Paris public prosecutor’s office had opened an investigation concerning an alleged attack on an automated data-processing system by an organized group.

Stolen funds may have been converted into cryptocurrency

The bank’s latest explanation raised the possibility that the attackers moved the stolen money into cryptocurrency after transferring it to other financial institutions.

However, the lender did not confirm that cryptocurrency purchases had occurred or identify any trading platforms, digital assets or wallet addresses involved.

Before the disclosure, crypto.news reported ZachXBT’s investigation into a suspected theft exceeding $133 million from an unidentified Western European financial institution.

On November 3, the blockchain investigator described suspected withdrawals through centralized cryptocurrency exchanges, followed by transfers involving USDC, USDT and Ethereum.

His findings identified transactions through instant-exchange services, while other funds were allegedly converted into the privacy-focused cryptocurrency Monero.

The investigator claimed that more than $30 million had already been laundered and questioned why the affected institution had not disclosed the incident.

Those allegations preceded Arkéa’s public announcement, and the bank has not independently confirmed that all the transactions identified by ZachXBT were connected to its systems.

The group has not disclosed whether investigators have identified the final destination of the missing money.

Crédit Mutuel Arkéa warns customers about phishing attempts

Despite maintaining that customer accounts were unaffected, the lender warned that criminals could exploit the incident to carry out phishing attacks.

The bank explained that such attacks sometimes lead to fraudulent messages designed to obtain confidential financial information from customers.

It urged clients never to disclose banking passwords, account identifiers, card numbers or SMS verification codes to anyone requesting them.

Customers receiving suspicious messages were advised to contact their banking advisers directly instead of responding to the sender.

The warning did not establish that customer information had been compromised, and the bank did not report any confirmed theft of customer data.

Crédit Mutuel Arkéa serves more than 5.8 million members and customers through its regional banking federations and approximately 40 specialized subsidiaries, including Fortuneo.

Its security teams are working with judicial and police authorities to determine the origin of the attack and the methods used by those responsible.