Skip to content

Which companies just had a verified incident, who lends to them and who owns them. Every claim carries its evidence level and its source. How we decide what is confirmed

Global Financial Service Disruptions

Credit Mutuel Arkea

commercial bank · FR · Europe · Credit Mutuel Arkea SA (press reports Fortuneo as origin; bank denies entry via Fortuneo)

Confirmed cyberStatus: recoveringTier 1Severity 4 of 5Evidence confidence: highAnalyst-verified

Credit Mutuel Arkea announced on 4 Nov 2026 that it had been the victim of an attack that allowed fraudulent operations; attackers came in through a service provider's platform and used the bank's own account to send transfers to other banks. As a precaution the bank temporarily suspended certain transactions, delaying some customer transfers, and said client balances were unaffected. Press estimates of about EUR 118M were not confirmed, though the bank said the order of magnitude was right.

Original: Credit Mutuel Arkea annonce avoir ete victime d'une attaque ayant permis la realisation d'operations frauduleuses ... la decision a ete prise, par mesure de precaution, de suspendre temporairement certaines transactions.

First disruption
Nov 1 12:25 UTC
First public signal
Nov 2 (On-chain investigator ZachXBT public alert naming suspected bank victim (per prior DFX register, not re-fetched))
Acknowledged
Nov 4
Restored
Nov 4
Duration
not established
DFX first recorded
Nov 5 14:58 UTC

What was restricted

transfers outScope: institution wide

Bank: no impact on client balances; precautionary temporary suspension of certain transactions and delayed execution of some transfers on 4 Nov, resuming progressively during the morning.

Financial impact: Not confirmed by bank. Bank 'does not confirm' the press figure of about EUR 118M (USD 133M, ZachXBT estimate) but says the order of magnitude is right; part of the funds blocked. Estimate, unconfirmed.

Cause, kept in separate layers

What the institution said
Bank: victim of an 'attaque' enabling fraudulent operations; attackers 'passed through the platform of one of our service providers' and used the bank's own account; sophisticated external attack, no human error.
DFX classification
Confirmed cyber (cyber: confirmed)
Analytical hypothesis (not established)
Third-party platform compromise used to instruct transfers from the bank's own nostro/proprietary account to other banks, then crypto off-ramp. Provider identity undisclosed; no evidence links Arkea Banking Services or Monext.
Wording used
par mesure de precaution, l'incident est maitrise, les avoirs des clients ne sont pas impactes, execution differee de certaines operations de virement
Conflicting reports
Amounts range USD 106M to 133M+ / EUR 100M to 118M, largely from one on-chain source; bank confirms only order of magnitude. Some reports say the app was inaccessible, the bank says only some transfers were delayed. Press names Fortuneo; bank denies entry via Fortuneo. A web search in this lane failed to surface the event (index lag), but both bank releases were fetched directly.

Dependencies

A dependency is a documented relationship. It is not evidence that the provider was compromised.

  • Provider: Unnamed service provider platform (Entry point per bank), verified
  • Downstream: Crypto exchanges (Kraken, Crypto.com, OKX per on-chain reporting) and Tether (about USD 1.14M frozen): Received and paid out or froze proceeds (plausible)

Evidence