Credit Mutuel Arkea cyberattack: €118M stolen through a service provider, protect your transfers
A bank losing about €118 million (roughly US$133 million) isn’t the same scale as a small business in Laval. But the way it happened does concern you directly. The attackers didn’t come through Crédit Mutuel Arkéa’s front door. They went through a service provider’s platform, then used the bank’s own account to send transfers to other banks. The money was then converted into cryptocurrency.
Your business also has providers connected to your money: the payroll service, the accounting firm, the invoicing software linked to your bank, your online store’s payment platform, sometimes your IT provider. Here’s what happened and the controls that stop a similar scenario at your company.
Credit Mutuel Arkea cyberattack: the timeline
According to the firm Bitquery, US$108.8 million in USDC was withdrawn from accounts at Kraken, Crypto.com and OKX within 21 hours. Part of it was converted into ether, which no one can freeze.
Independent investigator ZachXBT publicly reports a theft of more than US$106 million, without knowing the victim yet.
ZachXBT finds another US$27 million withdrawn from exchanges: the total passes US$133 million, and could be higher.
ZachXBT names Crédit Mutuel Arkéa. The bank confirms a “sophisticated external attack” that went through “the platform of one of our service providers”, temporarily suspends some transfers and says its customers suffer no losses. Part of the funds is blocked, including by Crypto.com and OKX. The Paris prosecutor opens an investigation.
According to published reports, the transfers landed in accounts opened under fake identities on crypto exchanges. Some of the money had reportedly already been converted into Monero, a cryptocurrency that is very hard to trace. The provider still hasn’t been named.
What stands out: the theft spread over several days, around a weekend, and the first public alert came from an investigator watching blockchains, not from the victim. Investigators will have to explain how transfers of this size got through.
What you see and what lies beneath
Which controls stop which scenarios
Three realistic scenarios for a small business, and what each banking control stops:
| Control | Provider hacked (payroll, accounting, software) | Stolen banking password | Fake email from the CEO or a supplier |
|---|---|---|---|
| Dual approval: one person prepares, another approves | ✔ | ✔ | ◐ |
| Per-transfer and daily limits, lower on weekends | ◐ | ◐ | ◐ |
| Approved payee list, additions confirmed by phone | ✔ | ✔ | ✔ |
| Text or email alerts for every transfer and every new payee | ◐ | ◐ | ◐ |
| Provider access: prepare only, never approve | ✔ | ✖ | ✖ |
| MFA with an app or security key for every banking user | ◐ | ✔ | ✖ |
✔ stops the scenario · ◐ limits the damage or speeds up detection · ✖ doesn’t help. Option names vary from bank to bank: ask your advisor about “dual authorization”, “limits” and “payee management”.
No single control is enough. The pair that makes the biggest difference: dual approval and a payee list where every addition is confirmed by calling a known number. That’s also what stops fake-email fraud, like what we saw after an email marketing platform was hacked.
Frequently asked questions
Q1. My accounting firm has access to my bank account. Is that a problem?
Not in itself, but check exactly what access. View-only access is enough for most accounting tasks. If they prepare payments, they should never be able to approve them alone. Also ask whether they use MFA and how they protect their own computers.
Q2. My payroll service pays salaries. What should I do?
Ask in writing how they validate a change to an employee’s bank account and how they would notify you of an incident. Compare each payroll register with the previous one: a new account or an unusual amount should jump out.
Q3. How much time do I have to react to a fraudulent transfer?
Very little. Call your bank immediately (the number on the back of your card or in your contract, not one from an email), ask for a recall of the transfer, then report the fraud to the Canadian Anti-Fraud Centre and the police. Every hour counts.
Q4. I’m a Crédit Mutuel customer. Should I worry?
The bank says customer assets are not affected. Be most wary of emails, texts and calls that use this news to get you to “confirm” your login details: your bank will never ask for your codes.
How NeoTech can help
We list with you the providers that have access to your accounts and financial software, reduce that access to the minimum, turn on MFA everywhere and help you ask your bank for the right settings. Our automated 24/7 monitoring with on-call technician intervention responds to suspicious sign-ins to your Microsoft 365 accounts, including evenings and weekends. Learn about our cybersecurity services.
Book your free cyber check
In 30 minutes, we look at who can prepare, approve or change a payment in your business, including your providers, and what an attacker could do with just one of those accesses.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- Crédit Mutuel Arkéa — additional information following the attack, Nov. 4, 2026 (in French)
- 01net — a hacked service provider, millions laundered in crypto, Nov. 5, 2026 (in French)
- CoinDesk — ZachXBT names Crédit Mutuel Arkéa as suspected victim, Nov. 4, 2026
Photo: Tima Miroshnichenko, Pexels (Pexels licence).