Author: Shenchao TechFlow
Introduction: On November 4, 2026, Beijing time, Fortuneo, the online bank under the French mutual credit Arkia Group, confirmed that it had suffered a fraudulent cyberattack. The attackers bypassed the bank's remittance risk controls and sent funds directly to external accounts. On-chain tracking agencies detected more than $133 million in assets flowing out, an amount that has set a recent record for a single cyber theft at a traditional financial institution. Unlike the external credential leaks suffered by traditional banks in Japan, South Korea, and the Americas, this incident marks that hackers have directly breached the core outbound fund gate inside a commercial bank.
Failure of the Bank's Internal Control Gate Triggers Crypto Withdrawals
According to a first-hand investigation disclosed by crypto journalist Grégory Raymond, Fortuneo's core defense line suffered a fundamental breach. During the attack, the fraudsters obtained the authority to directly initiate outbound transfers and could arbitrarily set payee names, thereby bypassing the bank's routine real-name verification barrier for payees.
The attack group preemptively used false identities to complete customer identity verification on compliant exchanges such as Kraken and Crypto.com. The fraudulent funds were then directly remitted by Fortuneo to the exchanges' custodial addresses according to the real-name account information, indicating that the trading platforms' own account systems were not compromised; the point of failure originated entirely from the risk control circulation mechanism inside the commercial bank.
Stablecoin Money Laundering Network Settles Through Cross-Chain Mixing
After the fiat currency was received, it was quickly converted by the hackers into on-chain assets. Monitoring data from the on-chain tracking agency Bitquery shows that the first batch of funds withdrew from Crypto.com at 12:25 UTC on November 1, and 44 minutes later high-frequency outflows also successively appeared from Kraken's custodial addresses.
On-chain detective ZachXBT tracked and pointed out that the attackers' total money laundering amount was initially estimated at $106 million in stablecoins, and was subsequently verified and raised to more than $133 million. During the night of November 1 to 2, the attackers concentrated about $63 million in USDC and USDT through the decentralized exchange Uniswap and converted them into 27,553 ETH.
This batch of ETH assets was then dispersed and injected into instant exchange platforms and cross-chain channels, and some positions were further transferred into Monero for settlement. Industry intelligence analysis believes that because some funds may be transferred through offline over-the-counter trading and traditional acceptance channels, Fortuneo's actual exposure is still continuously expanding.
Global Financial Offense and Defense Show Polarized Forms
While the core clearing channel of the French online bank was directly breached, other financial institutions around the world are facing AI-driven flank information warfare. South Korea's financial regulatory authorities disclosed that 16 institutions, including Shinhan Bank and KB Kookmin Bank, have suffered attacks from the ARTEX penetration tool since the end of September, with hackers invoking Claude and DeepSeek models to scrape about 100,000 personal credit files.
The Latin American security team Straiker also monitored an automated tool named CARLIY 0S in October. The hacker group CyberCartel used multiple large models to breach more than 400 financial endpoints in bulk and illegally steal 4,493 API keys and login credentials. During the same period, the State Bank of India also had the data of 3,897 customers leaked on the dark web.
Sawyer Savings Bank in New York State and Hilltop Bank in Wyoming both interrupted services in the third quarter due to hidden dangers from third-party software suppliers. However, the core accounts of banks in Japan, South Korea, the Americas, and South Asia were not damaged; only France's Fortuneo suffered a substantive interception of funds that directly penetrated fiat currency and on-chain assets.
French judicial and financial regulatory authorities have intervened to investigate whether Fortuneo suffered a targeted scam involving the forgery of executive authority, and the on-chain monitoring team is carrying out round-the-clock address tagging on several unknown money laundering routing nodes holding ETH balances.
