Key takeaways
- Hackers accessed bank funds without compromising customer accounts
- A trusted service provider became the attack's entry point
- Crypto exchanges helped expose suspicious transfers and stolen funds
A French bank lost approximately €100 million in a sophisticated cyberattack, yet its customers reportedly lost nothing. The explanation reveals a surprising distinction between stealing money from a bank and stealing money from the people who keep their savings there.
Crédit Mutuel Arkéa confirmed on November 4 that attackers accessed its systems through an external service provider and initiated unauthorized transfers using the bank's own account. In an official statement, the institution emphasized that the attackers had not accessed customer accounts belonging to its subsidiaries or regional networks.
By November 5, approximately €100 million remained unaccounted for, according to Reuters. However, the bank said the incident had been contained and would not threaten its financial stability.
How Hackers Stole Bank Money Without Accessing Deposits
The attack began outside the bank's direct infrastructure.
According to Crédit Mutuel Arkéa, hackers compromised the platform of an external service provider that had access to its financial systems. They subsequently used the bank's own account to transfer money to other financial institutions.
Crucially, the attackers did not enter through Fortuneo, Arkéa's online banking subsidiary, despite earlier reports suggesting otherwise.
The distinction matters because customer deposits and a bank's own financial resources are not interchangeable.
Banks record customer deposits as liabilities, representing money owed to depositors. They also hold assets, capital and operational funds used to conduct their business.
In this case, the fraudulent transfers originated from an account belonging to Arkéa itself rather than individual customer accounts.
That does not make the theft harmless. A loss of €100 million can reduce a bank's financial resources even when depositors' balances remain.
Why Kraken Detected a Theft the Bank Couldn't Immediately Stop
The stolen funds reportedly moved through traditional banking channels before being converted into cryptocurrencies.
According to Le Monde's investigation, cryptocurrency exchange Kraken detected unusually large transactions involving a European banking institution and blocked transfers in progress.
Blockchain investigator ZachXBT had separately identified suspicious cryptocurrency movements before Arkéa publicly confirmed the incident.
The case demonstrates why cryptocurrency exchanges can sometimes help investigate financial crimes even when the original theft occurs through conventional banking systems.
Unlike the recent Binance infrastructure attack, Arkéa's breach reportedly began through a third-party banking service rather than cryptocurrency transaction-signing infrastructure.
Nevertheless, both incidents illustrate how trusted authorization systems can become security weaknesses.
Earlier third-party exploits have exposed similar concerns within decentralized finance, where compromised service providers can create losses without breaching the main platform.
Who Pays When a Bank's Own Money Is Stolen?
For customers, the immediate result was disruption rather than missing balances.
Arkéa temporarily suspended certain transactions while strengthening security controls, delaying some payments. The bank subsequently resumed nearly all operations and said customer assets remained unaffected.
The financial burden instead falls initially on the institution, although the eventual loss will depend on how much money investigators recover.
The incident raises questions similar to those emerging around AI banking agents: the danger of software or service providers having permission to initiate financial transactions.
A separate banking security controversy previously demonstrated how losses from institutional funds can differ from losses involving customer assets.
