Hackers drain €100 million from French bank – CEO suspects AI

What happened

The French banking and insurance group Crédit Mutuel Arkéa, based in Brittany, has been hit by an unusually large cyberattack. Its subsidiaries include Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest and the online bank Fortuneo. The attackers got away with around €100 million (roughly $112 million). They didn't take it from customer accounts. They took it straight from the bank's own accounts, and the money then turned up on crypto exchanges.

The case is also drawing attention because of something CEO Julien Carmona said. He called it a "new kind of heist" in which artificial intelligence was very likely involved. The bank hasn't provided any technical evidence for that claim yet. The Paris prosecutor's office is investigating.

How the attack unfolded

According to the Ukrainian tech site hi-tech.ua, it all started outside the bank's network. On October 27, Arkéa spotted signs that an external service provider's systems had been compromised. The bank cut the connection and notified the authorities. At that point it saw no reason to think the stolen data could be used to break into its own IT. The bank won't name the provider, so other companies running similar systems aren't put at risk. Le Monde, as quoted by Computing UK, reports that this provider was authorized to carry out transactions on the bank's behalf. That gave the attackers far-reaching access, all the way to the bank's own funds.

hi-tech.ua says the attackers generated fake IBANs from the Fortuneo service and used them to trigger payment orders from Arkéa accounts to outside recipients. They used instant transfers, which arrive within seconds. Carmona says these systems have fewer checks than conventional transfers. The money started flowing out on Sunday, November 1. It went to real accounts at other, legitimate European banks that the fraudsters had opened beforehand. From there it was moved onto crypto platforms to cover the trail.

One contradiction is still unresolved. According to Computing UK, a bank spokesperson rejected media reports that Fortuneo was the entry point and said Fortuneo and its customers' accounts weren't affected. RFI reports that the group also stresses that no customer accounts were accessed for the transfers, and it rules out human error inside the bank.

The bank discovered the full scale of the attack on the morning of November 3. It blocked external access to its information system, disconnected from the interbank payment system, deleted the fake accounts and changed credentials. Some transfers were delayed. RFI reports that almost everything was running normally again by Wednesday morning.

Following the crypto: how much money is really gone?

Blockchain analysts noticed the unusual transactions as early as Sunday and Monday. Well-known on-chain investigator ZachXBT flagged suspicious outflows of more than $106 million on November 2. He later raised his estimate to over $133 million and named Crédit Mutuel Arkéa as the affected bank on November 4. Reports compiled by shattered.io say the attackers used USDC and USDT and swapped them into Ethereum and Monero, which is considered hard to trace. That hasn't been confirmed. hi-tech.ua reports that analytics firm Bitquery traced $108.8 million in USDC, a stablecoin pegged to the dollar, flowing out through Kraken, Crypto.com and OKX within 21 hours.

According to Computing UK, US exchange Kraken raised the alarm on Monday after unusually large deposits arrived from a European bank, and it blocked transactions that were still pending. Regional newspaper Le Télégramme and crypto outlet CoinDesk reported a figure of up to €118 million. The bank hasn't confirmed that number, but RFI says it acknowledged that it's roughly the right size. The bank says part of the money has already been frozen. It won't say how much.

shattered.io notes that these figures don't necessarily contradict each other. On-chain totals are calculated at market prices at a specific moment, and they can include amounts that were frozen later or related wallets.

What role did AI play?

Carmona described the attackers as an exceptionally well-organized and well-equipped criminal group backed by advanced AI. The bank hasn't presented any evidence, and so far nobody has claimed responsibility. hi-tech.ua points out that almost every technique involved existed before the AI boom: the breach at the service provider, stolen credentials, forged payment orders, money-mule accounts and laundering through crypto. AI might have helped with reconnaissance, writing code or forging documents to open the accounts. None of that has been confirmed.

Security expert Rafay Baloch, CEO of RedSecLabs, told Reuters the incident was unprecedented in Europe:

"We are seeing a lot of these sophisticated application-layer attacks and clever social engineering against banking institutions."

Gabriel de Brosses, former head of cybersecurity at Groupe La Poste, told Computing UK the episode would "send a wave of fear through every institution in the sector." Puneet Kakkar of investigations firm Nardello & Co said French banks are well protected thanks to strict regulation, but criminals are getting more opportunistic and more creative.

The investigation and what it means for the bank

The Paris prosecutor's office opened an investigation on November 4 after the bank filed a complaint. The charge is attacking an automated data processing system as part of an organized gang. The case is being handled by OFAC, the specialist cybercrime unit. Arkéa has also notified the European Central Bank and the French banking regulator.

The group serves 5.8 million customers, manages more than €211 billion in assets and posted a net profit of €230 million in the first half of 2026. So the loss comes to almost half a half-year's profit. The bank says its financial stability isn't at risk. Customers should watch out for phishing emails that use the incident as bait. The bank hasn't said whether any customer data was taken.

Some reports linked the case to the record hack at crypto exchange Binance around the same time. According to Computing UK, $6.3 billion was stolen there, partly through fake job interviews and a compromised internal AI tool. shattered.io says there's no evidence connecting the two.

Analysis

It's rare for attackers to pull money straight out of a major European bank's own coffers. Most fraud targets individual customers. The case exposes two weak spots. First, supply chain risk is huge: an external provider with payment rights became the way in. Second, instant transfers are fast and crypto exchanges make it easy to move money out of sight before a bank can react. On the plus side, Kraken and blockchain analysts raised the alarm early, and some of the money was frozen.

Treat the CEO's AI theory with caution. There's no evidence for it yet, and "AI-powered attack" is also a convenient story for a bank, one that can distract from its own failings. The biggest questions are still open: How exactly did the attackers get in, who is behind it, and how much money is gone for good?