French banking group Crédit Mutuel Arkéa says an attacker accessed its network through a service provider’s platform and used the bank’s own account to make fraudulent transfers, BleepingComputer reported on November 7. The bank suspended some systems, delaying certain transfers, but says customer assets were unaffected.
The cooperative banking group, which has more than 5.8 million members and €211.5 billion in assets, disclosed the incident on November 4. It said the incident was contained and operations were gradually returning to normal across its federations and subsidiaries.
The potential loss is substantial. Blockchain fraud investigator ZachXBT estimated that up to €118 million ($133 million) may have been stolen. Arkéa declined to confirm that figure, acknowledging only its order of magnitude and saying some funds had been blocked.
Transfers from the bank’s own account
In a separate FAQ described by BleepingComputer, Arkéa said the attacker reached its network directly through a service provider’s platform. It ruled out Fortuneo as the platform involved.
The attacker then used Arkéa’s own account, rather than customer accounts, to transact with other banking institutions and convert funds into cryptocurrency. The bank ruled out human error within its organization and characterized the incident as a “sophisticated attack.”
Reports first emerged on November 2, when ZachXBT warned of large unauthorized withdrawals from multiple centralized cryptocurrency exchange accounts the previous day. Such exchanges hold and handle cryptocurrency transactions for account holders. The investigator said the attacker may have withdrawn the funds as USDC and USDT, stablecoins designed to track the value of the US dollar.
ZachXBT initially did not identify the affected entity. The investigator also claimed that the absence of public disclosure allowed the attacker to launder $30 million by November 3, funds that European Union law enforcement would otherwise have frozen.
Arkéa is working with judicial authorities and police to establish the attack’s exact origin and how it was carried out. BleepingComputer said it had sought further details from the bank about the attack and investigation but had received no response by publication.
Customers warned about phishing
For customers, the bank reported delays in executing some transfers while maintaining that their assets were unaffected. It also warned of increased phishing risk: fraudulent communications intended to trick recipients into revealing sensitive information.
Arkéa urged customers to remain alert to unsolicited messages and avoid sharing sensitive details by phone or email. Customers receiving suspicious communications should verify them by calling their bank adviser directly.
