French Bank Confirms Cyberattack After Report of €118 Million in Fraudulent Transfers

Attack Confirmed, Loss Figure Unverified

Crédit Mutuel Arkéa, a French cooperative bank, has confirmed that a cyberattack hit its systems. French media reported that attackers moved approximately €118 million out of the bank through fraudulent transactions, then split the funds among multiple cryptocurrency accounts. The bank has not confirmed that figure. In its statement, it said the attack has been contained and that customers will not suffer any financial loss. The statement did not include a timeline, the number of affected accounts, or the type of transactions involved. Media reports citing the €118 million figure may be drawing on preliminary information from law enforcement or other sources, but until the bank issues an official figure, the amount remains unverified. The bank’s wording also leaves open whether the bank itself will absorb the reported loss or whether insurance or other mechanisms will apply. Public information about the incident is limited. The bank has not published a detailed incident report, and the figure of €118 million appears only in media accounts.

Fraudulent Transactions and Crypto Distribution

The reported chain of events is short: fraudulent transactions moved money out of the bank, and the stolen funds were then sent to cryptocurrency wallets. In a banking context, a fraudulent transaction typically involves an attacker gaining access to a legitimate transaction channel or tricking internal approval processes into authorizing an unauthorized transfer. Distributing the proceeds across multiple crypto accounts complicates tracing efforts because blockchain addresses can transfer assets quickly and are not always tied to a known identity. The available report says the money went to multiple cryptocurrency accounts, but does not specify whether these were exchange-hosted wallets, self-custodied wallets, or a mix. Exchange wallets can sometimes be frozen through requests to the exchange operator, while self-custodied wallets are harder to control without private keys. The bank has not said whether any of the cryptocurrency addresses have been identified, whether funds have been frozen or recovered, or whether it is working with law enforcement or blockchain analytics firms. Without those details, the difficulty of recovering the funds cannot be assessed. Fraudulent transfers in banking can result from compromised credentials, social engineering of employees, or weaknesses in payment workflows. Once funds enter cryptocurrency, recovery depends on timely identification of addresses and cooperation with exchanges or law enforcement. The absence of such details in the bank’s statement leaves the incident unresolved.

Partial Suspension of App Transfers

In response to the incident, Crédit Mutuel Arkéa has suspended some transfer functions in its mobile application. The scope of the suspension has not been disclosed, and it is unclear whether it affects personal customers, business accounts, or both. The bank has not said whether the restriction applies to other channels such as online banking or branch-initiated transfers, nor has it provided a timeline for restoring full functionality. The bank’s statement that customers will not suffer any losses is a standard reassurance, but the temporary loss of certain app functions could still disrupt routine transactions. Customers will need to monitor the bank’s communications for updates on when normal transfer services resume. The decision to suspend only a subset of transfer functions rather than freezing all digital banking suggests an attempt to maintain some operations while containing the damage, but the bank has not explained its reasoning. This partial measure may be reviewed as more information about the attack becomes available.

Open Questions

Several pieces of information remain missing. The final loss figure may differ from the €118 million reported by French media. The bank has not commented on whether law enforcement or blockchain analytics firms are involved in tracing the cryptocurrency transfers. It has also not explained how the fraudulent transactions were initiated, whether the attack involved phishing, malware, or an insider, or which internal controls failed. The duration of the transfer restrictions is also unknown. Until the bank releases more details, the incident stands as an example of fraudulent wire activity moving money quickly into crypto, with the public left to reconstruct the sequence from a brief official statement and press reports. The coming days may bring confirmation of the loss amount, information on frozen assets, and a clearer picture of the attack path. For now, the bank’s confirmation and the reported figure remain two separate pieces of information, one official and one not yet verified.