French lender Crédit Mutuel Arkéa said on Thursday, November 5, that hackers had stolen around €100 million in a cyber heist and that it was working to recover the money — a rare case of cybercriminals successfully stealing from a mainstream bank, Reuters reported from Paris.

Source: Reuters via Northland News Radio, Nov 5

The attackers used an account belonging to Crédit Mutuel Arkéa itself to carry out “fraudulent transactions”, the bank said in a statement on Wednesday, when the attack was made public. The funds were not in the form of cryptocurrency, the bank said, but could have been converted into crypto after being stolen. Arkéa reached through the platform of a third-party service provider, according to the bank's account reported by AFP — the bank declined to identify that provider, ruled out human error, and described the attack as sophisticated and external, saying the incident has since been contained.

Source: Reuters, Nov 5; AFP reporting via Pollar, Nov 5

The bank temporarily suspended some transactions as a precaution, causing delays to some transfers, but said customer assets were not affected. A spokesperson rejected media reports that its online banking subsidiary Fortuneo was the entry point for the attack, saying neither that division nor its customers' accounts were involved — a denial the bank repeated in its AFP-reported statements.

Source: Reuters, Nov 5

Paris prosecutors open an organised-crime cyber investigation

The Paris prosecutor's office said its cybercrime unit received a complaint from Crédit Mutuel Arkéa on Wednesday and immediately opened an investigation, led by France's cybercrime police. The prosecutor's office confirmed to AFP that the case concerns an attack on an automated data-processing system by an organised group, and that it has been handed to the anti-cybercrime office (OFAC). The bank said it had informed the European Central Bank, French banking supervisors and prosecutors; France's banking regulator, the ACPR, declined to comment.

Source: Reuters, Nov 5; AFP via Pollar, Nov 5

The size of the loss is still provisional. AFP reported that the bank put its provisional estimate at about €100 million (about $112 million). Blockchain investigator ZachXBT, who first flagged suspicious fund movements on November 1–2 linked to an unnamed European entity, puts the theft at more than $133 million — a figure Arkéa did not confirm: a spokesperson told Reuters the losses were lower than ZachXBT's estimate and that it was still too early to give a final amount. The bank said the losses do not threaten its financial strength.

Source: AFP via CryptoNews Australia, Nov 5

Why experts call this attack unprecedented in Europe

Cyber experts told Reuters that while cyberattacks on banks are common, it is unusual for money actually to be stolen virtually from a bank. Rafay Baloch, CEO of the cybersecurity firm RedSecLabs, said the Crédit Mutuel attack was unprecedented in Europe, pointing to sophisticated attacks at the application layer and social-engineering attacks on banking institutions. “Any time you have a hit in the financial system, it's a big deal,” said Puneet Kakkar, a managing director at Nardello & Co in Paris, who noted that French banks typically have strong cybersecurity because of regulatory requirements — but that cybercriminals are becoming more opportunistic and more creative. Regulators globally have stepped up warnings about cyber risk, particularly with the growth of AI, Reuters reported.

Source: Reuters, Nov 5

The heist lands in an exceptional run of attacks: Reuters placed it after last week's $6.3 billion cryptocurrency theft from Binance and a wave of cyberattacks targeting internet-connected fridges in Europe. The standing precedent remains 2016, when attackers stole $81 million from the Bangladesh central bank's account at the Federal Reserve Bank of New York; Reuters has also reported millions stolen from banks in Russia and India in past cyberattacks.

Source: Reuters, Nov 5

What happens next

Investigators from France's cybercrime police and the OFAC will try to trace the fraudulent transfers — including any conversion into cryptocurrency — while the bank works to recover and, where possible, block the stolen funds. The case will also test Europe's banking supervisors: Arkéa has notified the European Central Bank and French supervisors, and the ACPR's silence so far means the regulatory verdict on how a mainstream bank lost €100 million through a supplier's platform is still to come.