French Online Bank Breached for Over $133 Million as Hackers Use Encrypted Channels for Cross-Chain Money Laundering

Author: TechFlow

TechFlow Summary: On November 4, 2026, Beijing Time, Fortuneo, an online bank under France's Crédit Mutuel Arkéa Group, confirmed it fell victim to a fraudulent cyberattack. The attackers bypassed the bank's remittance risk controls and directly transferred funds to external accounts. On-chain tracking agencies monitored outflows exceeding $133 million in assets, setting a recent record for a single theft at a traditional financial institution. Unlike traditional banks in Japan, South Korea, and the Americas that suffered external credential leaks, this incident marks hackers having directly breached the core internal withdrawal gates of commercial banks.

Breach of Internal Bank Controls Triggers Crypto Withdrawals

According to exclusive investigation disclosures by crypto journalist Grégory Raymond, Fortuneo's core defense lines suffered a fundamental breach. During the attack, the fraudsters gained the authority to initiate outgoing transfers directly, allowing them to arbitrarily set recipient names, thereby circumventing the bank's daily real-name verification barriers for payees.

The attack syndicate pre-emptively used fake identities to complete customer identity verification on compliant exchanges such as Kraken and Crypto.com. The fraudulent funds were subsequently transferred directly from Fortuneo to the exchanges' custody addresses according to the verified account information, indicating that the trading platforms' own account systems remained intact. The compromised point originated entirely from the internal risk control and fund flow mechanisms within the commercial bank.

Stablecoin Laundering Network Settled via Cross-Chain Mixers

Once the fiat currency was received, it was quickly converted into on-chain assets by the hackers. Monitoring data from on-chain tracking agency Bitquery shows that the first batch of funds was withdrawn from Crypto.com at 12:25 UTC on November 1. Forty-four minutes later, high-frequency outflows were also observed from Kraken's custody addresses.

On-chain detective ZachXBT tracked the incident, noting that the total laundered amount was initially estimated at $106 million in stablecoins, later verified and revised upward to over $133 million. During the night of November 1 to 2, the attackers centrally exchanged approximately $63 million worth of USDC and USDT for 27,553 Ethereum via the decentralized exchange Uniswap.

This batch of Ethereum assets was subsequently dispersed into instant swap platforms and cross-chain bridges, with some positions further funneled into Monero settlements. Industry intelligence analysis suggests that due to some funds possibly being transferred via offline OTC trades and traditional acceptance channels, Fortuneo's actual exposure continues to expand.

Global Financial Defense and Offense Shows Bifurcation

While France's online bank faced a direct breach of its core clearing channel, other financial institutions globally are confronting AI-driven flanking information warfare. South Korean financial regulators disclosed that 16 institutions, including Shinhan Bank and KB Kookmin Bank, have been targeted by the ARTEX intrusion tool since late September. Hackers utilized Claude and DeepSeek models to scrape approximately 100,000 personal credit files.

Latin American security team Straiker also detected an automation tool named CARLIY 0S in October. The hacker collective CyberCartel leveraged multiple large language models to bulk-penetrate over 400 financial endpoints, illegally stealing 4,493 API keys and login credentials. National Bank of India also experienced a leak of 3,897 customer records on the dark web during the same period.

Sawyer Savings Bank in New York and Hilltop Bank in Wyoming both experienced service disruptions in the third quarter due to vulnerabilities in their third-party software vendors. However, the core accounts of banks in Japan, South Korea, the Americas, and South Asia remain unaffected. Only France's Fortuneo suffered actual fund interception, directly bridging fiat and on-chain assets.

French judicial and financial regulators have intervened to investigate whether Fortuneo fell victim to a targeted fraud involving forged executive permissions. On-chain monitoring teams are currently conducting 24/7 address tagging against several unknown money-laundering routing nodes holding Ethereum balances.