.png "Global Insight")
A French bank has confirmed it was hit by a sophisticated cyberattack — and the story broke on the blockchain before it came from the bank. Crédit Mutuel Arkéa, a Brittany-based cooperative banking group, said on Wednesday 4 November 2026 that an attack had allowed fraudulent transactions, but that the incident was now contained and customers had suffered no losses.
Related reading: North Korea Denied the $6.3 Billion Binance Hack — Missiles, Denials and a Bigger Pattern.
What the bank confirmed — and what it did not
Arkéa said hackers gained access to the bank's own account to make transfers to other banks — not to client accounts — and that the stolen funds were then converted into cryptocurrencies on specialised platforms. A portion had been blocked, and recovery efforts were under way. The bank said it had excluded human error and described the attack as sophisticated and coming from outside. The Paris public prosecutor's office told AFP it had opened an official investigation into an "attack on an automated data processing system by an organized group."
Crucially, Arkéa has not confirmed a total sum. That matters, because the headline figure comes from elsewhere, and the two numbers in circulation measure different things.
Where the €118 million figure comes from
Independent blockchain investigator ZachXBT first flagged more than $106 million in suspicious withdrawals on 2 November, tied at first to an unnamed European institution, and later raised his estimate to more than $133 million (about €118 million) and named Arkéa, according to CoinDesk. Arkéa has said the reported order of magnitude is valid, without confirming the exact figure. AFP, meanwhile, reported the fraudulent transactions as amounting to around €100 million ($112 million), citing the bank's statement — a reminder that the final loss depends on how much is frozen or recovered, which is not yet known.
Blockchain analytics firm Bitquery traced about $108.8 million in USDC stablecoins withdrawn from accounts at Kraken, Crypto.com and OKX over about 21 hours on 1–2 November, with about $63 million swapped into 27,553 ether in about four hours through the decentralised exchange UniswapX. Those on-chain traces and ZachXBT's wider estimate should not be added together: they cover different perimeters, and ZachXBT himself has said his total could rise further once over-the-counter trades are counted.
Why this case matters beyond one bank
According to Arab News, reporting AFP, Arkéa earned a net profit of €230 million in the first half of the year — so a gross loss near €118 million would equal roughly half that result, though the bank said the amount was not such as to undermine its financial health. Arkéa serves more than 5.6 million customers and, per other reporting, holds over €200 billion in assets; it stressed that customer deposits remained fully protected.
The deeper lesson is about how bank fraud now moves. The attackers did not, on the bank's account, raid customer accounts one by one. They allegedly used the bank's own account, moved money through other banks and crypto exchanges, and converted it within hours — faster than traditional recovery processes can easily follow. One later report said the attackers entered through a platform operated by an external service provider, though Arkéa has rejected suggestions that its online banking subsidiary Fortuneo was the entry point. Until the investigation reports, that entry route remains attributed, not established — but the speed of the crypto conversion is already reshaping how banks think about fraud controls.