Hackers Steal $133 Million from French Bank Crédit Mutuel Arkéa via Compromised Service‑Provider Platform

What happened

On 2 Nov 2026, blockchain‑fraud analyst ZachXBT identified a large unauthorized stablecoin withdrawal linked to Crédit Mutuel Arkéa. The bank later confirmed that attackers had breached a service‑provider platform, used the bank’s own accounts to initiate transfers to other banks, and converted the funds into USDC/USDT, resulting in an estimated loss of €118 million (≈ $133 million). Crédit Mutuel Arkéa suspended affected systems, blocked further transfers, and is cooperating with French authorities. No customer assets were directly stolen, but transaction processing was delayed and the bank warned of increased phishing risk.

Why it matters for trust and compliance

• The incident demonstrates why continuous third‑party risk monitoring and documented vendor‑oversight controls are essential for trust and control‑assurance across frameworks.
• Demonstrates the need for real‑time evidence of vendor assessments and access logs.
• Supports audit readiness by mapping vendor‑oversight activities to a single control objective that satisfies multiple frameworks.

Who is affected

Recommended actions

1. Review and tighten third‑party access controls; ensure contracts include continuous monitoring clauses.
2. Collect and retain evidence of vendor risk assessments, privileged‑access logs, and incident‑response steps for audit purposes.