French Bank Credit Mutuel Arkea Confirms Cyberattack as ZachXBT Puts Losses Above $133 Million
Bank says hackers used its own account for transfers
French bank Credit Mutuel Arkea said a cyberattack let hackers carry out fraudulent transfers from the bank's own account. On-chain investigator ZachXBT has put the losses at more than $133 million.
The bank said the incident is under control. Operations are resuming. Customer assets were not affected. The bank paused some transactions as a precaution.
Key numbers and confirmed details
- The bank confirmed a cyberattack and fraudulent transfers from its own account.
- ZachXBT estimates losses of more than $133 million. The bank has not confirmed that figure.
- The bank said part of the funds has been frozen and recovery steps are under way.
- No customer accounts at its federations or subsidiaries were used, the bank said.
How the bank describes the attack
The bank said attackers entered through the platform of one of its service providers and reached the bank directly. The attackers then used the bank's own account to send money to other banks.
The bank said that path could then have let the attackers convert the money into crypto through specialised platforms. The bank denied press reports that the entry point was Fortuneo, its online banking arm.
The bank called it a sophisticated attack from outside. It said it was not caused by human error. It also warned customers that phishing attempts are possible after the attack.
What ZachXBT reported
ZachXBT first reported the incident on Monday. He did not name the victim at first. He said an EU entity was suspected of losing more than $106 million on Nov. 1 from several centralised exchange accounts. A centralised exchange is a platform where users trade crypto.
He said the funds were first withdrawn as USDC and USDT. Those are stablecoins, which are crypto tokens designed to stay near the value of one US dollar. He said the funds were then swapped for ether and moved across several chains.
He later added more than $27 million in exchange withdrawals. That brought his total estimate to more than $133 million. A later post named Credit Mutuel Arkea as the alleged victim. He also said the attack may have lasted for several days and the total could be larger if over-the-counter activity is counted.
Loss figure still unconfirmed
The bank has not given a final loss figure. Asked about 118 million euros, or $133 million, it said it does not confirm the number. It said it can only validate the order of magnitude.
AFP reported a provisional estimate of about 100 million euros from the bank. Reuters reported earlier that the bank said losses were lower than $133 million. A bank spokesperson told Reuters it was too early for a final figure.
The bank said the amounts involved are not large enough to threaten its financial health. It did not confirm ZachXBT's figure or timeline. It has not said when the attack began, who carried it out, or whether data was taken.
Investigation and what happens next
The bank said it is working with judicial and police authorities to find the origin of the attack and how it was carried out. It said it informed its supervisors after the attack was detected.
The bank groups the Credit Mutuel federations of Brittany and the Southwest. Reuters reported it has 5.8 million clients and 211.5 billion euros in assets. How much money can be recovered and what the final loss will be remain unclear.
Sources for this article
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.
Related Posts
