French Cooperative bank Crédit Mutuel Arkéa has disclosed a cyber attack that enabled an attacker to steal up to $133 million (118 million Euros) from one of its centralized accounts and transfer the funds into USDC and USDT stablecoins.
Crédit Mutuel Arkéa serves roughly 5.8 million customers and reported €211.5 billion in assets, making it one of the country’s largest banks.
The social engineering attack was conducted by state-sponsored North Korean hackers who used fake job interviews to trick an employee into downloading malicious software. Crédit Mutuel has confirmed that the incident did not affect customer bank accounts.
French bank Crédit Mutuel Arkéa suspends transactions following cyber attack
Crédit Mutuel has confirmed that it was the victim of a “sophisticated attack” that resulted in the theft of a substantial sum of money.
The security incident forced the French cooperative bank to shut down impacted systems to contain the threat actor’s activity, disrupting some banking operations. Crédit Mutuel said it would resume normal operations after conducting security checks and implementing additional security measures.
However, Crédit Mutuel said the cyber attack did not affect customer accounts and that customers’ funds remained secure.
“Crédit Mutuel Arkéa wishes to reassure all its clients – across its federations and subsidiaries – that this incident has no impact on their assets; it has merely resulted in a delay in the execution of certain transfer transactions,” the bank stated.
Nevertheless, Arkéa urged customers to remain vigilant against phishing attempts, warning them against unsolicited communications from individuals claiming to represent the bank or requesting personal information. They should also confirm any communication by contacting the bank directly before authorizing any transaction.
According to the French bank, the attacker compromised a third-party service provider to breach its centralized account, initiate transactions with other banks, and convert the loot into cryptocurrency.
Meanwhile, Crédit Mutuel has launched an investigation involving relevant judicial and law enforcement authorities, including the French Cyber Police, to determine how the attacker gained access.
So far, Arkéa has not disclosed the threat actor’s identity, how they gained access, or which third-party service provider was affected. However, the bank has denied that the cyber attack targeted Fortuneo, one of its online stock exchange service providers. The financial services provider has also ruled out human error or insider threats.
“Contrary to what may have been written, no ‘entry’ was made by Fortuneo. The attackers went through the platform of one of our service providers and thus reached Crédit Mutuel Arkéa directly,” the bank stated.
The attack has been attributed to the state-sponsored North Korean hacking group known as TraderTraitor, with blockchain sleuth ZachXBT, who first reported the heist, ruling out the Lazarus Group.
“The most dangerous security failures aren’t always vulnerabilities in code. Sometimes they’re flaws in what a business process is willing to trust,” said Darin Fredde, Senior Director and Offensive Security Evangelist, Ridge Security. “We need to be careful about drawing conclusions from headlines. We know what Crédit Mutuel Arkéa has disclosed, but we don’t know the complete attack sequence.”
So far, Crédit Mutuel has recovered part of the stolen funds. In a Telegram post, ZachXBT says the attacker was busy laundering some of the stolen funds across multiple chains and crypto exchange platforms. The blockchain researcher also faulted the bank for delaying notifications for up to two days, allowing the attacker to transfer part of the loot. Nevertheless, Crédit Mutuel says the incident “is now closed and under control.”
Banks and crypto exchange platforms are a prime target
The cyber attack follows a security breach at Binance, the world’s largest cryptocurrency exchange, in which attackers reportedly stole $6.34 billion in just 20 minutes. According to media reports, the suspected North Korean hackers tricked an employee into downloading trojanized versions of Homebrew software during a fake job interview. Binance has partnered with other crypto exchanges to freeze approximately $3 billion of the stolen funds.
Other major French banks have also experienced cyber attacks in the past. Between December 2025 and January 2026, a distributed denial-of-service (DDoS) attack hit French bank La Banque Postale, disrupting online banking services. In 2024, a similar attack targeted French Crédit Agricole.
France is also facing a wave of cyberattacks targeting cold storage facilities, including an incident that affected several blood banks. The attacks have also affected at least 700 supermarkets, triggering smoke and fires and causing millions of euros in food losses. Several countries across the world have urged citizens to stockpile food and water for at least 72 hours in anticipation of food supply chain attacks.
