The attackers used an account belonging to the bank to make “fraudulent transactions,” Credit Mutuel Arkea said. The stolen funds were not cryptocurrency, though the bank said they may have been converted into crypto after the theft. The bank temporarily suspended some transactions as a precaution, delaying some transfers, but said customer assets were unaffected.

A spokesperson rejected reports that Fortuneo, the group’s online banking subsidiary, was the entry point, saying neither the division nor its customers’ accounts were involved. The bank declined to name the third-party service provider whose platform was used. It said it had notified the European Central Bank, French banking supervisors and prosecutors.

The Paris prosecutor’s office said its cybercrime unit received the bank’s complaint on Wednesday and immediately opened an investigation, led by France’s cybercrime police. The bank made the attack public that day. The ACPR, France’s banking regulator, declined to comment.

Cybersecurity experts told Reuters that successful thefts from mainstream banks are unusual. Rafay Baloch, chief executive of RedSecLabs, called the attack unprecedented in Europe and said banking institutions face sophisticated application-layer and social-engineering attacks. Puneet Kakkar, managing director at Nardello & Co in Paris, said any breach of the financial system was significant and warned that cybercriminals were becoming more opportunistic and creative.

Brittany-based Credit Mutuel Arkea is a cooperative banking group with more than 5.8 million customers and €211.5 billion in assets. It belongs to the wider Credit Mutuel network while retaining significant strategic autonomy. The bank’s case follows other major cyber thefts, including the 2016 theft of $81 million from a Bangladesh central bank account at the Federal Reserve Bank of New York.