Hackers pull off $133 million French bank heist via service provider
French cooperative bank Crédit Mutuel Arkéa was targeted in a cyberattack that enabled fraudulent transactions of up to $133 million, forcing it to respond by suspending certain systems.
French cooperative bank Crédit Mutuel Arkéa was targeted in a cyberattack that enabled fraudulent transactions of up to $133 million, forcing it to respond by suspending certain systems.
The bank says that the attacker used its own account to initiate transactions to other banking organizations, but customer assets remain unaffected.
Crédit Mutuel Arkéa is a major French banking group with more than 5.8 million members and 211.5 billion euros in assets.
Reports about the incident emerged on November 2, initially from blockchain fraud investigator ZachXBT, who warned of a large-scale unauthorized withdrawal from multiple centralized exchange accounts occurring a day earlier.
At the time, ZachXBT did not name the entity but said that the lack of public disclosure allowed the attacker to launder $30 million by November 3, which EU law enforcement would otherwise have frozen.
Crédit Mutuel Arkéa disclosed the incident on November 4, assuring customers that it is now closed and under control and that operations are gradually returning to normal.
However, the organization also warned of increased phishing risk, urging customers to stay vigilant against unsolicited communications and avoid sharing sensitive details over the phone or email.
The attacker then used Arkéa’s own account, not customers' accounts, to transact with other banking institutions and convert funds into cryptocurrency.
According to the investigator, the attacker may have stolen up to 118 million euros ($133 million) and withdrawn it as USDC and USDT stablecoins.
While the bank did not confirm ZachXBT's estimation of the stolen amount, it acknowledged that the amount was significant and some funds were blocked.
BleepingComputer has contacted Crédit Mutuel Arkéa to learn more about the attack and the status of investigations, but we have not received a response yet.
All suspicious messages should be verified by calling the bank adviser directly.
What happened
French cooperative bank Crédit Mutuel Arkéa was targeted in a cyberattack that enabled fraudulent transactions of up to $133 million, forcing it to respond by suspending certain systems.
The bank says that the attacker used its own account to initiate transactions to other banking organizations, but customer assets remain unaffected.
Crédit Mutuel Arkéa is a major French banking group with more than 5.8 million members and 211.5 billion euros in assets.
What changed
Reports about the incident emerged on November 2, initially from blockchain fraud investigator ZachXBT, who warned of a large-scale unauthorized withdrawal from multiple centralized exchange accounts occurring a day earlier.
At the time, ZachXBT did not name the entity but said that the lack of public disclosure allowed the attacker to launder $30 million by November 3, which EU law enforcement would otherwise have frozen.
Crédit Mutuel Arkéa disclosed the incident on November 4, assuring customers that it is now closed and under control and that operations are gradually returning to normal.
Who is affected
However, the organization also warned of increased phishing risk, urging customers to stay vigilant against unsolicited communications and avoid sharing sensitive details over the phone or email.
The attacker then used Arkéa’s own account, not customers' accounts, to transact with other banking institutions and convert funds into cryptocurrency.
Why it matters
According to the investigator, the attacker may have stolen up to 118 million euros ($133 million) and withdrawn it as USDC and USDT stablecoins.
While the bank did not confirm ZachXBT's estimation of the stolen amount, it acknowledged that the amount was significant and some funds were blocked.
Response
BleepingComputer has contacted Crédit Mutuel Arkéa to learn more about the attack and the status of investigations, but we have not received a response yet.
What security teams should do
All suspicious messages should be verified by calling the bank adviser directly.
Attribution
BleepingComputer: French cooperative bank Crédit Mutuel Arkéa was targeted in a cyberattack that enabled fraudulent transactions of up to $133 million, forcing it to respond by suspending certain systems.