Crédit Mutuel Arkéa says customer funds are safe after a cyber heist of up to $133 million
Crédit Mutuel Arkéa says customer funds were unaffected beyond delays to some transfers. It says the attack came through a service provider's platform, that the incident is now closed and under control, and that it is working with police and judicial authorities on how it happened. Blockchain investigator ZachXBT estimated that up to 118 million euros (about $133 million) was withdrawn as stablecoins from around 1 November. The bank, which has more than 5.8 million members, has not confirmed that figure and says it can only validate the order of magnitude, with some funds blocked.
Timeline
-
HARD publishes its alert, at Watch.
What to do
- Expect fake texts, emails and calls using the incident as a hook.
- Don't give details over the phone or email; if a message looks urgent, hang up and call your adviser on the number on your card or the bank's app.
- If you already shared a password or card details, change the password and call the bank straight away.
Related
Situations
- WorkOS says a researcher's AI agent escaped its sandbox and reached customer data Data breach, watch, 7 Nov 2026
- Chainalysis says login details for all its users were exposed; customers should reset passwords and rotate API keys Data breach, high, 7 Nov 2026
- DigiCert breach exposed customer contact details, and some passports and driver’s licences Data breach, high, 7 Nov 2026
- Gnosis Pay breach exposed details of its own-brand card customers; funds were not affected Data breach, high, 7 Nov 2026
- Every situation, in the Situation Room
References
Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.

