French Bank Crédit Mutuel Arkéa Confirms Cyberattack as ZachXBT Puts Losses Above $133 Million
Key Takeaways
- •Crédit Mutuel Arkéa said attackers exploited a service provider's platform to reach the bank and used its own account to send fraudulent transfers to other banks, potentially converting the funds into cryptocurrency.
- •The bank stated that no customer accounts at its federations or subsidiaries were used, and it denied reports that entry occurred through its Fortuneo online banking arm, describing a sophisticated attack from the outside.
- •On-chain investigator ZachXBT tracked more than $133 million in withdrawals made as USDC and USDT that were later swapped into ether across several chains, while the bank has provisionally estimated the loss at around 100 million euros.
- •Part of the stolen funds has been frozen and recovery steps are underway, with the bank stating the amounts do not threaten its financial health as it works with judicial and police authorities to determine the attack's origin.
- •The incident follows within a week of the record $6.34 billion Binance hack, though ZachXBT expressed high confidence that North Korea's Lazarus Group was not involved in the attack on Crédit Mutuel Arkéa.
French bank Crédit Mutuel Arkéa confirmed on Wednesday that a cyberattack had allowed hackers to carry out fraudulent transfers from the bank's own account — a theft that on-chain investigator ZachXBT estimates at more than $133 million, a figure the bank has not confirmed.
The Brittany-based lender said in a statement that the incident was under control, that operations were resuming and that customer assets were not affected. It suspended some transactions as a precaution.
"This incident has had no impact on (customer) assets and has only caused a delay in the execution of certain transfers," the bank said on its website, in a translation published by Reuters.
In a follow-up question-and-answer note, Crédit Mutuel Arkéa said the attackers went through the platform of one of its service providers and reached the bank directly. They used the bank's own account to send transactions to other banks, which then potentially allowed them to convert the money into cryptocurrency through specialized platforms, the bank said.
No customer accounts at its federations or subsidiaries were used, according to the bank. It also denied French press reports that the attackers got in through Fortuneo, its online banking arm, describing the incident as "a sophisticated attack from the outside" rather than the result of human error.
The size of the loss
The bank has not given a final figure. Asked whether 118 million euros, or $133 million, had been stolen, it said it does not confirm the number and can only "validate the order of magnitude."
Part of the funds involved has been frozen, and other steps are underway to recover the rest, the bank said. It added that the amounts at stake are "absolutely not" large enough to threaten its financial health or soundness.
AFP reported that the bank put the attack at about 100 million euros in a provisional estimate. Earlier on Wednesday, Reuters reported that the bank said its losses were lower than $133 million. "It is still too early to give a final figure," a spokesperson told the wire service.
What ZachXBT reported
ZachXBT first flagged the incident on Monday without naming the victim. Writing on his Telegram channel, he said an EU entity was suspected of losing more than $106 million from multiple centralized exchange accounts on Nov. 1, with the funds withdrawn as USDC and USDT. The funds were then swapped for ether and moved across several chains, he said.
In an update, he said he had found another $27 million or more in exchange withdrawals, bringing the total to more than $133 million. A later post named Crédit Mutuel Arkéa as the alleged victim. He wrote that the attack "occurred for multiple days" and that he suspects the amount stolen is larger once over-the-counter activity is counted.
The bank has not confirmed his figure or his timeline. It has also not said when the attack began, who was behind it or whether any data was taken. Crédit Mutuel Arkéa is working with judicial and police authorities to determine the origin of the attack and how it was carried out, and said it informed its supervisors once the attack was detected. The bank also warned customers that phishing attempts are possible in the wake of the incident.
Background on the bank
Crédit Mutuel Arkéa, which groups the Crédit Mutuel federations of Brittany and the Southwest, is part of the wider Crédit Mutuel group. It has 5.8 million clients and 211.5 billion euros, or about $238 billion, in assets, Reuters reported. It posted net profit of 230 million euros in the first half of the year, AFP reported.
The hack lands less than a week after the record $6.34 billion Binance hack, which blockchain analysis firms have linked to North Korea. ZachXBT said in his first post that he was highly confident this incident was not the work of North Korea's Lazarus Group. Separately, Brazil's Mercado Bitcoin froze deposits and withdrawals this week after a security incident.
How much of the money the bank can recover, and what the final loss from the incident will be, remains open.
This article first appeared on Bitcoin Magazine and is written by Micah Zimmerman.
