French banking group Crédit Mutuel Arkéa has confirmed that hackers stole around €100 million from one of its accounts this week, prompting a French criminal investigation and efforts to recover the funds.

The bank said on Thursday that the attackers had accessed an account through a third-party service provider's platform and carried out fraudulent transactions. It has not yet established how much of the stolen money can be recovered.

Crédit Mutuel Arkéa said the incident had been contained and that customer accounts and assets were unaffected. The bank temporarily suspended some transactions as a precaution, however, delaying certain transfers.

The lender rejected reports that its online banking subsidiary Fortuneo was the entry point for the attack, saying neither the division nor its customers' accounts were involved. It declined to identify the service provider whose platform was compromised.

According to blockchain analysis company Bitquery, the stolen funds were transferred through several cryptocurrency exchanges before being distributed across 17 digital wallets. The attackers subsequently used decentralised finance platforms to convert most of the money into ethereum.

Bitquery said $21.6 million worth of ethereum remained in wallets linked to the thieves, alongside $12.3 million in DAI, a stablecoin. The remaining funds had been moved through cryptocurrency exchanges and other platforms.

The Paris prosecutor's office confirmed that its cybercrime unit received a complaint from the bank on Wednesday and immediately opened an investigation, which is being led by France's cybercrime police. Crédit Mutuel Arkéa said it had notified the European Central Bank and French banking supervisors.

Rafay Baloch, chief executive of cybersecurity firm RedSecLabs, told Reuters that the attack was unprecedented in Europe. He said financial institutions were increasingly being targeted through sophisticated application-layer attacks and social engineering.

Cybersecurity expert Gérôme Billois of consultancy Wavestone told the Financial Times that the incident was highly unusual for an international banking institution. He described it as a significant event for the financial industry.

Crédit Mutuel Arkéa, headquartered in Brittany, serves more than 5.8 million customers and has approximately €211.5 billion in assets. The potential loss represents around a quarter of its 2025 net profit of €450 million, although the final financial impact remains unclear.

The incident follows a series of attacks targeting financial institutions and other organisations in Europe. Last week, cryptocurrency exchange Binance suffered a reported $6.3 billion theft, while French supermarkets and healthcare facilities have faced separate cyberattacks.

---