French cooperative bank Crédit Mutuel Arkéa was targeted in a cyberattack that enabled fraudulent transactions of up to $133 million, forcing it to respond by suspending certain systems.
The bank says that the attacker used its own account to initiate transactions to other banking organizations, but customer assets remain unaffected.
Crédit Mutuel Arkéa is a major French banking group with more than 5.8 million members and 211.5 billion euros in assets.
Reports about the incident emerged on November 2, initially from blockchain fraud investigator ZachXBT, who warned of a large-scale unauthorized withdrawal from multiple centralized exchange accounts occurring a day earlier.
According to the investigator, the attacker may have stolen up to 118 million euros ($133 million) and withdrawn it as USDC and USDT stablecoins.
At the time, ZachXBT did not name the entity but said that the lack of public disclosure allowed the attacker to launder $30 million by November 3, which EU law enforcement would otherwise have frozen.
Movement of stolen funds
Source: ZachXBT
Crédit Mutuel Arkéa disclosed the incident on November 4, assuring customers that it “is now closed and under control” and that operations are gradually returning to normal.
“Crédit Mutuel Arkéa wishes to reassure all its clients – across its federations and subsidiaries – that this incident has no impact on their assets; it has merely resulted in a delay in the execution of certain transfer transactions,” [machine translated] the bank stated.
However, the organization also warned of increased phishing risk, urging customers to stay vigilant against unsolicited communications and avoid sharing sensitive details over the phone or email.
All suspicious messages should be verified by calling the bank adviser directly.
In a separate FAQ page, the bank explained that the attacker reached its network directly through a service provider’s platform, but ruled out Fortuneo.
The attacker then used Arkéa’s own account, not customers’ accounts, to transact with other banking institutions and convert funds into cryptocurrency.
While the bank did not confirm ZachXBT’s estimation of the stolen amount, it acknowledged that the amount was significant and some funds were blocked.
“Do you confirm that 118 million euros (133 million dollars) were stolen? We do not confirm this information and can only validate the order of magnitude.”
Arkéa ruled out human error at the bank and instead described the incident as a “sophisticated attack.”
The bank is currently working with judicial authorities and the police to establish the attack’s exact origin and modus operandi.
BleepingComputer has contacted Crédit Mutuel Arkéa to learn more about the attack and the status of investigations, but we have not received a response yet.
Adaptive Security’s AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.See what’s getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Start your free email security scan.
Click Here For The Original Source.
——————————————————–
