# Attackers Exploit Third-Party Service Provider Platform to Conduct Fraudulent Transfers Against French Bank Crédit Mutuel Arkéa (~€100–118M, Laundered via Stablecoins to Monero)

> Attackers reached Crédit Mutuel Arkéa through a service provider's platform and used the bank's own proprietary account to send fraudulent transfers to other banking organizations, which were converted to cryptocurrency. Reuters/Arkéa cite roughly €100 million; ZachXBT estimates up to €118 million ($133 million) withdrawn as USDC/USDT, with about $30 million laundered by November 3, 2026. The actor is unidentified and the provider has not been named.

- **Published:** 2026-11-09T00:05:14Z
- **Last reviewed:** 2026-11-09T00:05:14Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5513
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5513.png
- **ID:** TL-2026-5513
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 12

## Description

Crédit Mutuel Arkéa, a Brest-headquartered French cooperative bank and insurance group (Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest, Fortuneo, Suravenir; roughly 5.6-5.8 million customers, €211.5 billion in assets), disclosed on 4 November 2026 that it had been the victim of a cyberattack enabling fraudulent operations. According to the bank, the attackers entered through a service provider's platform and reached Arkéa directly; the bank explicitly denies entry through Fortuneo and denies human error, calling it a 'sophisticated attack from outside'. The provider has not been named by the bank or by the press.

The attackers used Arkéa's own proprietary account, not customer accounts of its federations or subsidiaries, to send transfers to other banking organizations, which the bank says may have allowed the funds to be converted into cryptocurrency. Arkéa says customer assets were unaffected, security systems detected the suspicious activity quickly, crisis procedures were activated, some transactions were temporarily suspended (delaying some transfers), some funds were blocked, and recovery efforts are ongoing. Arkéa does not confirm the €118 million figure and says it can only validate the order of magnitude; Reuters cites about €100 million.

On-chain investigator ZachXBT first reported on 2 November 2026 that an unnamed EU entity lost over $106 million in USDC and USDT withdrawn from multiple centralized exchange accounts (theft reported as occurring the previous day), raised the total to above $133 million on 3 November after tracing an additional ~$27 million, and named Arkéa that evening. He noted the real total could be higher once OTC trades are counted. Bitquery analysis relayed by IT-Connect indicates $108.8 million in USDC left Kraken, Crypto.com and OKX in 21 hours on 1-2 November to about 15 wallets (Kraken ~95%); $62.98 million in stablecoins was swapped for 27,553 ETH via UniswapX in about four hours; 11 of the 15 receiving wallets had earlier received payments from those platforms (oldest in May), suggesting the thief may have controlled those exchange accounts; about $61 million remained on Ethereum on 3 November; Tether froze only about 1.14 million USDT and Circle did not freeze USDC. An unconfirmed analysis by Grégory Raymond (cited by IT-Connect) hypothesizes that fiat was moved out of the bank to crypto accounts opened with fake identities passing KYC, via money mules; the bank has not confirmed this.

Laundering per ZachXBT: USDC swapped to ETH, funds sent to instant exchanges (WellWallet, Kyrrex), converted to XMR via Wagyu, and bridged across multiple chains. ZachXBT says with a high degree of confidence that the actor is not Lazarus Group, based on laundering indicators; no actor is otherwise named. ZachXBT also alleges lack of prompt public disclosure let ~$30 million be laundered before EU authorities could freeze funds. The Paris prosecutor's cybercrime unit opened an investigation after Arkéa's complaint (reported charge: unauthorized access to an automated data processing system by an organized gang), led by the Office anticybercriminalité (OFAC). Arkéa warned customers of elevated phishing risk. No CVEs, malware, wallet addresses, transaction hashes, or network IOCs (IPs/domains) have been published; BeaconBeagle correlation is not applicable as no network IOCs exist.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1585 Establish Accounts
- T1657 Financial Theft
- T1565.002 Transmitted Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5513 Third-Party Provider Account Sign-In From Multiple Sources (T1199 / T1078.004) — Exploitation Phase** (`TL-2026-5513-SPL-001`)

Detects successful Entra ID sign-ins by guest, vendor or service-provider style accounts that come from 3+ distinct IPs or 2+ countries within 24 hours. In the Crédit Mutuel Arkéa incident (TL-2026-5513) the attackers entered through an unnamed service provider's platform (Trusted Relationship, T1199) and abused valid provider access (Valid Accounts, T1078; cloud-identity variant T1078.004) to reach the bank's proprietary account. Provider identities that suddenly appear from several networks are a leading indicator of that access path being hijacked. No provider, IP or domain was published, so the logic is behaviour-first.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1199, T1078, T1078.004
- **Data sources:** azure_ad_signin_logs, splunk:azure:aad:signin, sentinel:SigninLogs
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=azure sourcetype=azure:aad:signin status.errorCode=0 (userType=Guest OR userPrincipalName=*svc* OR userPrincipalName=*vendor* OR userPrincipalName=*prestataire* OR userPrincipalName=*partner*) earliest=-24h | stats dc(ipAddress) as src_ip_count dc(location.countryOrRegion) as country_count values(ipAddress) as src_ips values(location.countryOrRegion) as countries values(appDisplayName) as apps min(_time) as first_seen max(_time) as last_seen by userPrincipalName | where src_ip_count>=3 OR country_count>=2 | eval risk=case(country_count>=2 AND src_ip_count>=3,"high", true(),"medium") | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
SigninLogs | where TimeGenerated > ago(24h) | where ResultType == 0 | where UserType == 'Guest' or UserPrincipalName has_any ('svc', 'vendor', 'prestataire', 'partner') | summarize SrcIpCount = dcount(IPAddress), CountryCount = dcount(tostring(LocationDetails.countryOrRegion)), SrcIps = make_set(IPAddress, 20), Countries = make_set(tostring(LocationDetails.countryOrRegion), 10), Apps = make_set(AppDisplayName, 20), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by UserPrincipalName | where SrcIpCount >= 3 or CountryCount >= 2 | extend Risk = iff(CountryCount >= 2 and SrcIpCount >= 3, 'high', 'medium')
```

### Sigma

```yaml
title: Third-Party Provider Account Sign-In To Payment Or Treasury Application
id: 3f6b1c52-8a4d-4e0b-9d57-2c1a7e94b3a1
status: experimental
description: Detects successful sign-ins by guest or provider-named accounts to payment, treasury or SWIFT related applications. Models the trusted-relationship access path used against Credit Mutuel Arkea (TL-2026-5513).
references:
    - https://securityaffairs.com/202628/cyber-crime/attackers-exploit-third-party-provider-to-raid-french-bank-credit-mutuel-arkea.html
    - https://www.bleepingcomputer.com/news/security/hackers-pull-off-133-million-french-bank-heist-via-service-provider/
author: Threadlinqs Team
date: 2026/11/09
tags:
    - attack.initial-access
    - attack.t1199
    - attack.t1078
    - attack.t1078.004
logsource:
    product: azure
    service: signinlogs
detection:
    selection_status:
        ResultType: 0
    selection_app:
        AppDisplayName|contains:
            - payment
            - treasury
            - swift
    selection_guest:
        UserType: Guest
    selection_name:
        UserPrincipalName|contains:
            - svc
            - vendor
            - prestataire
            - partner
    condition: selection_status and selection_app and (selection_guest or selection_name)
falsepositives:
    - Legitimate provider staff accessing payment applications during contracted support
    - Approved integration or batch accounts
level: medium
```

**Known false positives:**

- Legitimate provider support staff travelling or using multiple corporate VPN egress IPs
- Shared integration service accounts that legitimately authenticate from several datacenter IPs

**Tuning notes:** Replace the name patterns (svc, vendor, prestataire, partner) with your actual provider account naming or an Entra group lookup. Allowlist known provider egress IP ranges and raise or lower the src_ip_count and country_count thresholds. Verify field names against your Splunk Add-on for Microsoft Cloud Services version. The Sigma form is an event-level variant that focuses on payment/treasury app access; the SPL and KQL forms add multi-source aggregation.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5513 Provider Accounts Logging On To Multiple Servers (T1078.002 / T1199) — Exploitation Phase (locked: unlock with TL Creds)
- TL-2026-5513 Payment Control Changes Preceding Transfers: Limits Raised Or Dual Approval Disabled (T1565.002 / T1078) — Post-Exploitation Phase (locked: unlock with TL Creds)
- TL-2026-5513 Corporate Endpoint Egress To Instant Exchanges And Swap Services Linked To Arkéa Laundering (T1657) — Laundering Phase (locked: unlock with TL Creds)
- TL-2026-5513 Authentication Method Changes On Provider Accounts (T1098.005 / T1078.004) — Exploitation Phase (locked: unlock with TL Creds)
- TL-2026-5513 Provider-Channel Transfers From Proprietary Accounts (T1657 / T1199) — Post-Exploitation Phase (locked: unlock with TL Creds)
- TL-2026-5513 Account Opening Clusters Sharing Device Or KYC Artifacts (T1585 / T1656) — Resource Development Phase (locked: unlock with TL Creds)
- TL-2026-5513 High-Value Or High-Velocity Outbound Transfers From Bank Proprietary Account (T1657 / T1565.002) — Post-Exploitation Phase (locked: unlock with TL Creds)
- TL-2026-5513 Newly Opened Accounts Sending Funds To Crypto Exchange Beneficiaries (T1585 / T1656 / T1657) — Laundering Phase (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Attackers exploit third-party provider to raid French bank Crédit Mutuel Arkéa (Security Affairs)](https://securityaffairs.com/202628/cyber-crime/attackers-exploit-third-party-provider-to-raid-french-bank-credit-mutuel-arkea.html)
- [Hackers pull off $133 million French bank heist via service provider (BleepingComputer)](https://www.bleepingcomputer.com/news/security/hackers-pull-off-133-million-french-bank-heist-via-service-provider/)
- [French bank Crédit Mutuel Arkéa says 100 million missing after cyberattack (Reuters)](https://www.reuters.com/legal/government/french-bank-credit-mutuel-arkea-says-100-million-missing-after-cyberattack-2026-11-05/)
- [French bank Crédit Mutuel Arkéa exploited for over $133 million, ZachXBT says (The Block)](https://theblock.co/news/web3/2026-11-03-french-bank-credit-mutuel-arkea-exploited-zachxbt-432607)
- [Crédit Mutuel Arkéa press release announcing the cyberattack (PDF)](https://www.cm-arkea.com/arkea/banque/upload/docs/application/pdf/2026-11/04112026_-_communique_-_le_credit_mutuel_arkea_annonce_avoir_ete_victime_dune_cyberattaque__2026-11-04_15-40-19_385.pdf)
- [Crédit Mutuel Arkéa additional information following the attack (FAQ)](https://www.cm-arkea.com/arkea/banque/assurances/pa_38386/fr/informations-complementaires-suite-a-l-attaque-dont-le-credit-mutuel-arkea-a-ete-victime)
- [Cyberattaque Crédit Mutuel Arkéa / Fortuneo : 133 millions (IT-Connect)](https://www.it-connect.fr/cyberattaque-credit-mutuel-arkea-fortuneo-133-millions/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5513