French cooperative bank Crédit Mutuel Arkéa was the target of a cyberattack that enabled fraudulent transactions of up to $133 million, forcing it to respond by suspending certain systems.
The bank says the attacker used its own account to initiate transactions to other banking organizations, but customer assets are not affected.
Crédit Mutuel Arkéa is a large French banking group with more than 5.8 million members and 211.5 billion euros in assets.
Reports of the incident were published on November 2, initially by blockchain fraud investigator ZachXBT, who warned of a large-scale unauthorized withdrawal from multiple centralized exchange accounts that occurred a day earlier.
According to the investigator, the attacker could have stolen up to 118 million euros ($133 million) and delisted it as USDC and USDT stablecoins.
At the time, ZachXBT did not name the entity but said the lack of public disclosure allowed the attacker to launder 30 million dollars by November 3, when EU law enforcement would otherwise have frozen.
Source: ZachXBT
Crédit Mutuel Arkéa revealed the incident on November 4, assuring its customers that it “is now closed and under control” and that operations are gradually returning to normal.
“Crédit Mutuel Arkéa would like to reassure all of its customers – through its federations and subsidiaries – that this incident had no impact on their assets; it simply resulted in a delay in the execution of certain transfer operations,” the press release specifies. the bank said.
However, the organization also warned of an increased risk of phishing, urging customers to remain vigilant of unsolicited communications and avoid sharing sensitive information over the phone or email.
All suspicious messages should be verified by calling the bank advisor directly.
In a separate FAQ page, the the bank explained that the attacker reached its network directly through a service provider’s platform, but excluded Fortuneo.
The attacker then used Arkéa’s own account, and not those of customers, to carry out transactions with other banking institutions and convert funds into cryptocurrency.
Although the bank did not confirm the estimate of the amount stolen by ZachXBT, it acknowledged that the amount was large and that some funds had been blocked.
“Do you confirm that 118 million euros ($133 million) was stolen? We do not confirm this information and can only validate the order of magnitude.”
Arkéa ruled out any human error within the bank and instead described the incident as a “sophisticated attack”.
The bank is currently working with judicial authorities and the police to establish the exact origin of the attack and its method of operation.
BleepingComputer has contacted Crédit Mutuel Arkéa to find out more about the attack and the status of investigations, but we have not yet received a response.
Adaptive Security’s AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what’s happening with a 14-day read-only scan of Microsoft 365 or Google Workspace, without MX modifications.
