$133 million stolen from French bank via exploited service provider

Attackers siphoned an estimated $133 million from Crédit Mutuel Arkéa by using the bank’s own account to wire money to other banks, from where it was possibly converted into cryptocurrency.

The French cooperative banking group, which has €211.5 billion in total assets and more than 5.8 million customers, confirmed the attack days after blockchain investigator ZachXBT began tracking over $100 million in suspected stolen funds moving out of centralized exchange accounts.

Once the attack was detected, the group informed the relevant authorities and supervisors and temporarily suspended some transactions to stop further fraudulent transfers.

On November 3, he reported another $27 million in exchange withdrawals by the same threat actor, bringing the total to $133 million, and I suspect the amount stolen is larger when accounting for OTC activity, he added.

Its teams are working with judicial and police authorities to determine where the attack came from and the methods used, the bank added.

ZachXBT first flagged the incident in a community alert on his Telegram channel, saying an unnamed EU entity was suspected of losing over $106 million from multiple centralized exchange accounts on November 1.

The next day he named Crédit Mutuel Arkéa as the alleged victim, describing it as a French bank with $235 billion in assets.

He could not identify the attacker, but said he was confident

One of his sources described these networks as perfectly well-oiled structures, and Raymond believes the total losses may be higher than the $133 million visible on the blockchain.

According to his sources, networks using falsified identities had opened accounts at crypto exchanges, and each transfer was sent in the exact name of the account holder so it would pass checks that match the sender with the account owner.

Part of the funds has been blocked and other recovery efforts are under way, according to Arkéa, which added that it is too early to give a final amount.

Reports about the incident emerged on November 2, initially from blockchain fraud investigator ZachXBT, who warned of a large-scale unauthorized withdrawal from multiple centralized exchange accounts occurring a day earlier.

According to the investigator, the attacker may have stolen up to 118 million euros ($133 million) and withdrawn it as USDC and USDT stablecoins.