Crédit Mutuel Arkéa says attackers reached its own account through a provider, not Fortuneo

Crédit Mutuel Arkéa’s November 4 company release confirms a cyberattack that enabled fraudulent transactions. It says it contacted competent authorities and supervisors, mobilized its teams and temporarily suspended some transactions. It calls the incident contained/closed and reports progressive operational resumption during the morning after checks and stronger safeguards; its teams continue evaluating consequences and strengthening security. These are the bank’s statements, not an independent forensic conclusion or proof that every transfer has completed.

The bank says customer holdings across its federations and subsidiaries are unaffected and that some transfers were delayed. The initial release did not disclose an affected-customer count, detailed attack window, entry point, compromised software version, data-exposure scope or quantified loss. It says the amount is still being assessed and does not threaten the group’s financial strength. The release does not identify Fortuneo as the intrusion point or confirm ownership of wallets cited in earlier crypto reports. Transfers on a blockchain cannot establish this bank’s loss, the source of funds or the attack mechanism; no crypto-flow estimate is adopted here as a bank-confirmed amount.

L4 reflects the bank’s confirmation of real cyber-enabled financial fraud and transaction interruption. Customers have no published software patch to install. Follow the bank’s own service and adviser instructions, continue watching for phishing, and distinguish progressive recovery from completed investigation or independent verification of all balances.

November 4 follow-up: The bank now says attackers entered through an unnamed provider’s platform and reached Arkéa directly, not through Fortuneo. Fraudulent transactions used the bank’s own account to send money to other banking actors, which may then have enabled conversion through crypto platforms; customer accounts at its federations and subsidiaries were not used. The provider, technical entry method, destination-wallet ownership and crypto conversion remain unverified beyond that qualified statement by the bank.

Asked about €118M ($133M), the bank declines to confirm those exact figures and validates only their order of magnitude. It reports some funds blocked, ongoing recovery and a final financial impact still under assessment. Blocked funds are not returned funds, and the amount must not be presented as a confirmed final loss. The bank says nearly all operations resumed during the morning after checks, while some customer transfers were delayed. Its preventive phishing warning does not establish a customer-data breach.

November 5 research follow-up: Bitquery now traces $126.04M in USDC paid from Kraken, Crypto.com and OKX to 17 wallets, replacing its earlier $108.80M/15-wallet analysis. Two newly identified wallets account for about $17.2M paid on November 2 between 15:46 and 16:30 UTC; the researcher corrects its earlier claim that payouts ended that morning. This traces a suspected crypto cash-out leg, not the bank transfers themselves. At 08:47 UTC on November 5, the researcher counts $37.26M remaining in attributed Ethereum wallets, including 1.14M USDT frozen; neither remaining holdings nor freezes are confirmed returned funds. These figures and attribution remain unverified, and must not be added to the bank’s reported order of magnitude or called its final loss. The research cannot see bank transfers, verify exchange-account identities or reconcile every difference with earlier $133M reports. The bank’s own-account/provider-entry account and customer-holdings assurances remain the authoritative company position; this is not proof that any of those exchanges or Trust Wallet was compromised.