{
  "id": "arkea-banking-fraud",
  "url": "https://ohshit.app/incidents/arkea-banking-fraud/",
  "title": "Crédit Mutuel Arkéa says attackers reached its own account through a provider, not Fortuneo",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-04",
  "date_is_approximate": false,
  "updated": "2026-11-05",
  "tags": [
    "Arkéa",
    "banking",
    "fraud"
  ],
  "ecosystems": [],
  "summary": "Arkéa says attackers entered through a provider platform and used the bank’s own account, not customer accounts or Fortuneo. It confirms only the order of magnitude of reported €118M/$133M, with some funds blocked and final impact pending. Most operations resumed after checks; customer holdings are unaffected, the bank says.",
  "splash": "Crédit Mutuel Arkéa customers with delayed transfers; exact affected systems, subsidiaries and customer count are not disclosed.",
  "wipe": "Verify pending transfers through your usual bank channel and contact your adviser about suspicious messages or account activity.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Verify delayed transfers through your established banking channel",
      "hint": "Open your usual banking app/site or contact your established adviser. Ask about the status of a specific delayed transfer before submitting it again; the bank says some transfers were delayed and operations are resuming progressively. Preserve references and timestamps and follow your bank’s instructions rather than assuming every operation is restored. The later clarification says the fraudulent transfers used the bank’s own account rather than customer accounts; nearly all operations resumed during the morning, not necessarily every pending transfer. It explicitly rejects Fortuneo as the intrusion entry point."
    },
    {
      "title": "Verify messages with your adviser before responding",
      "hint": "The bank warns that phishing may exploit the incident. Do not disclose identifiers, passwords, card numbers or SMS approval codes in response to unexpected messages. Contact your adviser through an existing number or the normal app, not a link or number in the message."
    },
    {
      "title": "Report suspicious account activity and retain evidence",
      "hint": "Review account activity through your normal banking channel and promptly ask the bank about transactions you do not recognize. Keep the notice, transaction reference, amount and time for your adviser. The bank’s customer-protection statement is not an independent reconciliation of every account; do not send a crypto payment or share a wallet recovery phrase to purported recovery agents."
    }
  ],
  "sources": [
    {
      "name": "Crédit Mutuel Arkéa original company release via Actusnews Wire",
      "url": "https://www.actusnews.com/fr/credit-mutuel-arkea/cp/2026/11/04/credit-mutuel-arkea-annonce-avoir-ete-victime-d_une-cyberattaque",
      "says": "Company-authored regulated release, explicitly attributed to Crédit Mutuel Arkéa; full public text read by ordinary HTTP after the web reader failed. Confirms attack/fraud, temporary transaction suspension, progressive resumption, protected customer holdings, unknown amount and phishing precautions.",
      "primary": true
    },
    {
      "name": "Crédit Mutuel Arkéa original November 4 follow-up FAQ",
      "url": "https://www.cm-arkea.com/arkea/banque/assurances/pa_38386/fr/informations-complementaires-suite-a-l-attaque-dont-le-credit-mutuel-arkea-a-ete-victime",
      "says": "Company FAQ clarifies provider entry rather than Fortuneo, own-account transfers, near-total morning resumption, some blocked funds and only order-of-magnitude validation of reported €118M/$133M.",
      "primary": true
    },
    {
      "name": "Bitquery November 5 original cash-out research revision",
      "url": "https://www.bitquery.io/investigations/eu-106m-crypto-theft",
      "says": "Researcher’s own 17-wallet/$126.04M tracing, corrected November2 payout cutoff, November5 08:47UTC holdings/freeze snapshot and explicit limits on seeing bank transfers or exchange-account ownership. Not independent confirmation of the bank loss.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "The bank’s own November4 release confirms cyberattack-enabled fraudulent transactions.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 4, 2026",
      "title": "Bank confirms fraudulent transactions and reports progressive resumption",
      "body": "Its original company release says some transactions were suspended, authorities and supervisors informed, and operations were resuming after additional checks/security measures. The impact amount remains under assessment; the displayed publication time has no explicit timezone."
    },
    {
      "date": "Nov 4, 2026",
      "title": "Bank clarifies provider entry, account scope and amount uncertainty",
      "body": "The follow-up says entry was through a provider, not Fortuneo, and fraudulent transactions used Arkéa’s own account. It validates only the order of magnitude of the reported €118M/$133M, not those exact figures; some funds were blocked and recovery continues."
    },
    {
      "date": "Nov 5, 2026",
      "title": "Research revises the suspected crypto cash-out scope",
      "body": "Bitquery now traces $126.04M to 17 wallets and corrects its earlier morning-only cutoff to November 2 16:30 UTC after finding two more wallets. Its November 5 08:47 UTC snapshot reports $37.26M held and 1.14M USDT frozen. These are unverified on-chain estimates, not the bank’s final loss or recovered funds."
    }
  ],
  "body_markdown": "Crédit Mutuel Arkéa’s November 4 company release confirms a cyberattack that enabled fraudulent transactions. It says it contacted competent authorities and supervisors, mobilized its teams and temporarily suspended some transactions. It calls the incident contained/closed and reports progressive operational resumption during the morning after checks and stronger safeguards; its teams continue evaluating consequences and strengthening security. These are the bank’s statements, not an independent forensic conclusion or proof that every transfer has completed.\n\nThe bank says customer holdings across its federations and subsidiaries are unaffected and that some transfers were delayed. The initial release did not disclose an affected-customer count, detailed attack window, entry point, compromised software version, data-exposure scope or quantified loss. It says the amount is still being assessed and does not threaten the group’s financial strength. The release does not identify Fortuneo as the intrusion point or confirm ownership of wallets cited in earlier crypto reports. Transfers on a blockchain cannot establish this bank’s loss, the source of funds or the attack mechanism; no crypto-flow estimate is adopted here as a bank-confirmed amount.\n\nL4 reflects the bank’s confirmation of real cyber-enabled financial fraud and transaction interruption. Customers have no published software patch to install. Follow the bank’s own service and adviser instructions, continue watching for phishing, and distinguish progressive recovery from completed investigation or independent verification of all balances.\n\n**November 4 follow-up:** The bank now says attackers entered through an unnamed provider’s platform and reached Arkéa directly, **not through Fortuneo**. Fraudulent transactions used the bank’s own account to send money to other banking actors, which may then have enabled conversion through crypto platforms; customer accounts at its federations and subsidiaries were not used. The provider, technical entry method, destination-wallet ownership and crypto conversion remain unverified beyond that qualified statement by the bank.\n\nAsked about **€118M ($133M)**, the bank declines to confirm those exact figures and validates only their order of magnitude. It reports some funds blocked, ongoing recovery and a final financial impact still under assessment. Blocked funds are not returned funds, and the amount must not be presented as a confirmed final loss. The bank says nearly all operations resumed during the morning after checks, while some customer transfers were delayed. Its preventive phishing warning does not establish a customer-data breach.\n\n**November 5 research follow-up:** Bitquery now traces **$126.04M** in USDC paid from Kraken, Crypto.com and OKX to **17 wallets**, replacing its earlier $108.80M/15-wallet analysis. Two newly identified wallets account for about $17.2M paid on November 2 between **15:46 and 16:30 UTC**; the researcher corrects its earlier claim that payouts ended that morning. This traces a suspected crypto cash-out leg, not the bank transfers themselves. At **08:47 UTC on November 5**, the researcher counts **$37.26M** remaining in attributed Ethereum wallets, including **1.14M USDT frozen**; neither remaining holdings nor freezes are confirmed returned funds. These figures and attribution remain **unverified**, and must not be added to the bank’s reported order of magnitude or called its final loss. The research cannot see bank transfers, verify exchange-account identities or reconcile every difference with earlier $133M reports. The bank’s own-account/provider-entry account and customer-holdings assurances remain the authoritative company position; this is not proof that any of those exchanges or Trust Wallet was compromised."
}