French bank Crédit Mutuel Arkéa confirmed on 4 November 2026 that it was victim of a sophisticated external cyberattack, after investigator ZachXBT flagged the victim of a $130M to $133M+ exploit as a French bank with $235B in assets, reported in Telegram channels such as BWEnews and Rickler Feed.

French bank Crédit Mutuel Arkéa confirmed on 4 November 2026 that it was victim of a sophisticated external cyberattack, after investigator ZachXBT flagged the victim of a $130M to $133M+ exploit as a French bank with $235B in assets, reported in Telegram channels such as BWEnews and Rickler Feed.

The bank said attackers came through the platform of one of its providers and reached Arkéa directly, then used the bank’s own account for transfers to other banks. It denied entry via online bank Fortuneo, denied human error as cause, and said security systems contained the incident.

Arkéa did not confirm the €118M ($133M) figure named in the supplied summary, calling it only the right order of magnitude and saying it was too early for a final number. It said part of the funds were blocked and recovery efforts continue, with no threat to financial stability.

Client assets were not affected, only delayed execution of some transfers, which had mostly resumed by morning. Possible conversion to crypto was described as potential but not confirmed, and the provider was not named, according to the bank statement at cm-arkea.com.