$133 million stolen from French bank via exploited service provider

Attackers siphoned an estimated $133 million from Crédit Mutuel Arkéa by using the bank’s own account to wire money to other banks, from where it was possibly converted into cryptocurrency.

The French cooperative banking group, which has €211.5 billion in total assets and more than 5.8 million customers, confirmed the attack days after blockchain investigator ZachXBT began tracking over $100 million in suspected stolen funds moving out of centralized exchange accounts.

The bank disclosed the incident in a press statement released on November 4, saying it had been hit by “an attack that allowed fraudulent transactions to be carried out.” Once the attack was detected, the group informed the relevant authorities and supervisors and temporarily suspended some transactions to stop further fraudulent transfers.

“This incident has no consequences for their assets and has only caused a delay in the execution of certain transfers,” it told customers.

A theft traced on-chain

ZachXBT first flagged the incident in a “community alert” on his Telegram channel, saying an unnamed EU entity was suspected of losing over $106 million from multiple centralized exchange accounts on November 1. The funds were withdrawn as USDC and USDT stablecoins, and the thief then swapped them for ether, moved them through instant exchanges and converted part of them to Monero, he wrote.

He could not identify the attacker, but said he was confident “it is NOT Lazarus Group based on multiple laundering indicators.”

On November 3, he reported another $27 million in exchange withdrawals by the same threat actor, bringing the total to $133 million.

“My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up,” the investigator wrote. “No proper incident disclosure has resulted in $30M+ being laundered away which could have been frozen by EU law enforcement.”

The next day he named Crédit Mutuel Arkéa as the alleged victim, describing it as a French bank with $235 billion in assets. “The attack on the bank occurred for multiple days. I suspect the amount stolen is larger when accounting for OTC activity,” he added.

The Fortuneo claim

French journalist Grégory Raymond, who first linked the attack to Fortuneo, the group’s online bank, posted on X that the fraudsters were able to initiate transfers from Fortuneo while setting the beneficiary name themselves.

According to his sources, networks using falsified identities had opened accounts at crypto exchanges, and each transfer was sent in the exact name of the account holder so it would pass checks that match the sender with the account owner.

One of his sources described these networks as “perfectly well-oiled structures,” and Raymond believes the total losses may be higher than the $133 million visible on the blockchain. Arkéa rejects this, saying that contrary to some claims in the press, no “entry” was made through Fortuneo.

The bank’s version of events

The bank later published a Q&A addressing the main questions it had received about the attack. In it, Arkéa explained that the attackers did not go through the accounts of customers at its federations or subsidiaries, and reached the bank directly through the platform of one of its service providers, which it did not name.

The group denied that human error on its side caused the breach, and described it as a sophisticated attack from outside that has since been contained. Its teams are working with judicial and police authorities to determine where the attack came from and the methods used, the bank added.

Asked whether €118 million ($133 million) had been stolen, the bank declined to confirm the number and said it could “simply validate the order of magnitude.”

Part of the funds has been blocked and other recovery efforts are under way, according to Arkéa, which added that it is too early to give a final amount. It maintains that the sums involved do not threaten its financial health.

Phishing warning

The bank warned that phishing attempts may follow the attack and asked customers never to share login IDs, passwords, card numbers or verification codes received by SMS.

Asked whether this meant customer data had been compromised, the group said phishing campaigns often increase after attacks of this kind and that the warning was a preventive step.

“If in doubt, contact your bank adviser directly to confirm the message you received,” Arkéa advised.