French bank confirms cyberattack after $133M suspected losses flagged

Bank says client assets were not affected

French bank Crédit Mutuel Arkéa has confirmed a cyberattack led to fraudulent transfers from its own account. The bank said the money was then converted into crypto on specialised platforms.

The bank said client assets were not affected. It said the incident is contained. It said some customer transfers were delayed.

Key points

• Crédit Mutuel Arkéa confirmed the cyberattack and said it is contained.
• The bank said customer assets were not affected.
• ZachXBT estimated losses at more than $133 million.
• The bank did not confirm the exact loss amount.
• The bank said the amount is in the same order of magnitude as the $133 million estimate.
• The bank said some stolen funds have been blocked.

What the bank said in its statement

The bank said its teams put security measures in place as soon as the attack was found. It said the measures stopped further fraudulent movements against the bank.

The bank said the incident did not affect customer assets. It said the only customer impact was a delay for some transfers.

The bank said it is too early to give a final loss amount. It said the amount involved would not undermine its financial strength.

The bank has more than 12,000 employees and more than 5.8 million members and customers. It reported total assets of €211.5 billion, about $238.1 billion.

What ZachXBT reported on the crypto side

Onchain researcher ZachXBT first reported the incident on Nov. 2. He estimated losses at more than $133 million. He said the figure could rise because the attack lasted several days and may have included more over-the-counter trades. An over-the-counter trade is a private trade made directly between two parties, not on a public market.

ZachXBT reported that the attacker moved money through several steps. That included swapping USDC for ETH. USDC is a stablecoin, a type of crypto designed to keep a price close to one US dollar. ETH is the native crypto of the Ethereum network.

He also reported routing through instant exchanges and wallets. A wallet is a place used to hold crypto. An exchange is a platform where crypto can be traded or converted.

He said funds were also converted into XMR, a privacy-focused crypto, and moved across multiple blockchains. A blockchain is a shared record system for crypto transactions.

ZachXBT said he has a high degree of confidence the attacker was not linked to North Korea's Lazarus Group.

What is confirmed and what is not

Confirmed by the bank: a cyberattack happened, fraudulent transfers were made from the bank's account, customer assets were not affected, the incident is contained, and some stolen funds were blocked.

Not confirmed: the exact final loss amount. The bank said the $133 million estimate is correct in order of magnitude, but it has not confirmed that exact number as the final total.

Sources

• The Block