Hackers Used a Service Provider's Platform to Move Up to $133 Million Out of French Bank Crédit Mutuel Arkéa

Crédit Mutuel Arkéa, a French bank with 5.8 million members and customers, had attackers use its own account to wire money to other banks. The thieves may have taken up to 118 million euros, about $133 million, according to estimates. The bank will not confirm that number.

Blockchain investigator ZachXBT flagged the theft on Monday, after seeing large unauthorized withdrawals from several exchange accounts the day before. He later named Arkéa as the likely victim. The bank confirmed a "sophisticated attack" on Wednesday and said the incident was under control.

Through a vendor, not through Fortuneo

French press first said the attackers got in through Fortuneo, Arkéa's online banking subsidiary. The bank says that is wrong. In its follow-up FAQ, it says the attackers went through the platform of one of its service providers and reached the group directly. It has not named the provider.

From there, the attackers used Arkéa's own account to send transactions to other banks. The bank says that may have let them convert the money into cryptocurrency on specialised platforms. ZachXBT's read of the on-chain trail points the same way, with the money leaving as USDC and USDT stablecoins.

What the bank says is safe

Arkéa says customer accounts were not touched and that the attack only delayed some transfers. It rejects the idea of human error at the bank. It does warn customers to expect more phishing, which usually follows a headline like this one.

The size of the loss is still open. Arkéa says part of the money has been frozen and that it is working with judicial and police authorities to recover the rest. Reuters reported that roughly 100 million euros was still unaccounted for. The bank says the amount would not threaten its financial strength, and it reports total assets of 211.5 billion euros.

The pattern is the part other banks will study. Arkéa has not described any break-in to its core systems. A third-party platform with enough reach into the bank's own account was apparently enough to move on the order of $100 million. It is the same shape as other recent supply chain compromises of crypto firms, only with a bank's balance sheet at the other end.

Some offers on this page may be paid placements or contain affiliate links.