Crédit Mutuel Arkéa has confirmed that intruders reached one of its internal accounts by way of an unnamed third-party service provider, then pushed money out to other financial institutions where it may have been converted into cryptocurrency.
The regional banking group, which serves western France, disclosed the incident on Wednesday and said it suspended some transactions while it added controls. Operations were reported close to normal by the next morning. French law enforcement is investigating.
How the money left
Blockchain investigator ZachXBT flagged the activity on Monday before naming the suspected victim. The bank then confirmed the link. Le Tégramme put the loss at roughly €118M, more than $133M, and the bank told the newspaper that figure was in the right range while declining to certify it.
Funds moved out through transfers rather than customers’ stored balances. Arkéa said client assets were untouched and that the effect was delayed execution of certain payment orders. Some of the money has since been frozen and recovery work continues.
Why the supplier matters more than the sum
The entry point is the part worth studying. A provider with a foothold inside a bank’s workflow is a standing doorway, and European regulators have spent the past two years warning exactly about that exposure as financial firms lean harder on interconnected vendors.
For defenders, the practical questions are blunt. Which third parties can initiate or approve a payment instruction, and what stops one compromised operator seat from doing it? How fast can a bank freeze an outbound transfer, and does that runbook depend on the same provider that was hit?
Arkea’s own wording is the tell: it confirmed the order of magnitude, not the amount. Expect the final number to move once investigators finish tracing the chain.
