Thought Leadership
Crédit Mutuel Arkéa has acknowledged a major cyberattack. The attackers gained access to the bank’s network through a third-party service provider and stole funds directly from the bank itself. Blockchain investigator ZachXBT estimates the losses at up to €118 million.
The exact amount stolen remains unclear. In an FAQ, the French cooperative banking group explicitly declined to confirm the reported figure of €118 million, but acknowledged that the losses were substantial. Some of the stolen funds have since been frozen. The banking group serves more than 5.8 million members and has total assets of €211.5 billion. In response to the attack, it temporarily suspended selected systems.
Third-Party Provider Served as Entry Point
According to Arkéa, the attackers gained direct access to the bank’s network through a third-party service provider’s platform. The bank has not disclosed the provider’s identity. What happened next is particularly noteworthy: The attackers did not target customer accounts. Instead, they initiated payments from an account belonging to Arkéa itself, transferring funds to other banks before converting the money into cryptocurrency.
The bank has ruled out employee error and described the incident as a sophisticated cyberattack.
ZachXBT Exposes Incident Before Bank Responds
The first public indication of suspicious activity came from ZachXBT. On November 2, the blockchain investigator, who specializes in cryptocurrency-related fraud, reported large-scale unauthorized withdrawals via multiple accounts at centralized cryptocurrency exchanges in a Telegram post. The transactions had taken place on November 1, with the stolen funds converted into the stablecoins USDC and USDT.
At the time, ZachXBT did not identify the victim. However, he criticized the lack of public disclosure, warning that the delay had given the attackers time to launder as much as USD 30 million by November 3. Had the incident been reported earlier, law enforcement authorities in the EU might have been able to freeze those funds.
Arkéa did not issue a public statement until November 4. According to the bank, the incident had been contained and was under control. Services were gradually being restored. The attack had no impact on customer funds, although some transfers were processed later than scheduled.
Bank Warns Customers About Potential Phishing Attempts
At the same time, the bank expects fraudsters to exploit the incident for phishing campaigns. Customers are advised to be wary of unexpected contact attempts and never disclose confidential information over the phone or by email. Anyone who is unsure about a communication should call their bank advisor directly using a trusted contact number.
The police and judicial authorities are now investigating the details of the attack and the individuals behind it. Arkéa says it is cooperating with the authorities. The bank has so far not responded to an inquiry from BleepingComputer regarding the status of the investigation.
(Editorial Team)
