French cooperative bank Crédit Mutuel Arkéa was hit by a cyberattack that allowed an attacker to conduct transactions worth up to $133 million via a service provider's platform, forcing the bank to suspend certain systems. The bank has assured customers that their assets are unaffected, though some transfer transactions were delayed.
The incident first came to light on November 2, when blockchain fraud investigator ZachXBT warned of a large-scale unauthorised withdrawal from multiple centralised exchange accounts a day earlier. ZachXBT said the attacker may have stolen as much as 118 million euros ($133 million) and withdrawn it as USDC and USDT stablecoins. At the time, the investigator said the lack of public disclosure allowed the attacker to launder $30 million by November 3, which EU law enforcement would otherwise have frozen.
Crédit Mutuel Arkéa disclosed the incident on November 4, stating that it "is now closed and under control" and that operations are gradually returning to normal. The bank said the attacker reached its network directly through a service provider's platform, ruling out its subsidiary Fortuneo, and then used Arkéa's own account, not customer accounts, to transact with other banking institutions and convert the funds into cryptocurrency.
In a separate FAQ page, the bank did not confirm ZachXBT's estimate but acknowledged that the amount was significant, saying, "We do not confirm this information and can only validate the order of magnitude." Arkéa described the incident as a "sophisticated attack" and ruled out human error at the bank. The bank is working with judicial authorities and the police to establish the attack's exact origin and modus operandi.
The bank also warned of an increased phishing risk, urging customers to stay vigilant against unsolicited communications and to verify suspicious messages by calling their bank adviser directly.
Analysis
Why This Matters
- The heist highlights vulnerabilities in the connections between banks and third-party service providers, a growing vector for financial cybercrime.
- The speed with which funds were laundered (US$30 million in two days) underscores the difficulty of freezing stolen assets once they enter cryptocurrency exchanges.
- Customers face heightened phishing risk as attackers may use the incident to trick them into revealing sensitive information.
Background
Crédit Mutuel Arkéa is a major French cooperative banking group with €211.5 billion in assets. The attack reportedly originated through a service provider's platform rather than directly breaching the bank's own systems. The theft, if confirmed at €118 million, would be one of the larger cyber heists against a European bank in recent years.
Key Perspectives
Crédit Mutuel Arkéa: The bank says the incident is closed and under control, customer assets are unaffected, and the attacker used the bank's own account via a service provider. It describes the attack as "sophisticated" and denies human error.
ZachXBT (blockchain fraud investigator): The investigator first reported the theft on November 2, estimating losses at up to €118 million, and noted that delayed public disclosure allowed the attacker to launder US$30 million before law enforcement could act.
What to Watch
- The outcome of the French judicial and police investigation into the attack's origin and method.
- Whether the bank is able to recover any of the stolen funds from the cryptocurrency exchanges where they were withdrawn.
- Potential regulatory or industry-level responses regarding third-party service provider security in banking.
Checked
12 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedThe bank said the incident “is now closed and under control.”BleepingComputer: “Crédit Mutuel Arkéa disclosed the incident on November 4, assuring customers that it “is now closed and under control” and that operations are gradually returning to normal.”
- SupportedThe bank said it could not confirm the reported amount but could validate its order of magnitude.BleepingComputer: “"Do you confirm that 118 million euros (133 million dollars) were stolen? We do not confirm this information and can only validate the order of magnitude."”
- SupportedThe bank described the incident as a “sophisticated attack.”BleepingComputer: “Arkéa ruled out human error at the bank and instead described the incident as a "sophisticated attack."”
- SupportedZachXBT said as much as $133 million may have been stolen.BleepingComputer: “According to the investigator, the attacker may have stolen up to 118 million euros ($133 million) and withdrawn it as USDC and USDT stablecoins.”
- SupportedThe cyberattack enabled fraudulent transactions worth up to $133 million and led the bank to suspend certain systems.BleepingComputer: “French cooperative bank Crédit Mutuel Arkéa was targeted in a cyberattack that enabled fraudulent transactions of up to $133 million, forcing it to respond by suspending certain systems.”
- SupportedThe bank said customer assets were unaffected.BleepingComputer: ““Crédit Mutuel Arkéa wishes to reassure all its clients - across its federations and subsidiaries - that this incident has no impact on their assets; it has merely resulted in a delay in the execution of certain transfer transactions,” [machine translated] the bank stated.”
- SupportedSome transfer transactions were delayed.BleepingComputer: ““Crédit Mutuel Arkéa wishes to reassure all its clients - across its federations and subsidiaries - that this incident has no impact on their assets; it has merely resulted in a delay in the execution of certain transfer transactions,” [machine translated] the bank stated.”
- SupportedThe bank acknowledged that the amount was significant.BleepingComputer: “While the bank did not confirm ZachXBT's estimation of the stolen amount, it acknowledged that the amount was significant and some funds were blocked.”
- SupportedReports about the incident emerged on November 2, after a withdrawal reported by ZachXBT a day earlier.BleepingComputer: “Reports about the incident emerged on November 2, initially from blockchain fraud investigator ZachXBT, who warned of a large-scale unauthorized withdrawal from multiple centralized exchange accounts occurring a day earlier.”
- SupportedZachXBT said the attacker may have stolen up to 118 million euros and withdrawn it as USDC and USDT.BleepingComputer: “According to the investigator, the attacker may have stolen up to 118 million euros ($133 million) and withdrawn it as USDC and USDT stablecoins.”
- SupportedZachXBT said the attacker laundered $30 million by November 3 because there had been no public disclosure.BleepingComputer: “At the time, ZachXBT did not name the entity but said that the lack of public disclosure allowed the attacker to launder $30 million by November 3, which EU law enforcement would otherwise have frozen.”
- Partly supportedThe bank ruled out its subsidiary Fortuneo as the route into its network.BleepingComputer: “In a separate FAQ page, the bank explained that the attacker reached its network directly through a service provider’s platform, but ruled out Fortuneo.”
