French Bank Crédit Mutuel Arkéa Hit by Reported $133m Heist Through a Service Provider

Crédit Mutuel Arkéa, a leading French banking group, has confirmed it was the victim of an attack that allowed fraudulent transactions to be carried out. In a statement issued on November 4, the bank said the incident has no financial consequences for its customers. It explained that the attackers used the bank's own account to send money to other banking institutions, not customer accounts belonging to its federations or subsidiaries. The bank said this may have let them convert the funds into cryptocurrency through specialised platforms.

According to the bank's FAQ, the attackers reached its network through the platform of a service provider. The incident first surfaced on November 2, when blockchain investigator ZachXBT claimed on Telegram that an unnamed EU entity had lost $106m from multiple centralised exchange accounts. A day later, the investigator reported a further $27m in suspicious withdrawals, bringing the reported total to about $133m. ZachXBT ruled out the North Korean Lazarus Group and criticised the lack of proper disclosure, saying it allowed more than $30m to be laundered that could have been frozen.

Crédit Mutuel Arkéa says it is still too early to confirm how much was taken. Its teams are assessing the financial impact, some of the funds have been frozen, and other actions are underway to recover them. The bank says it activated security measures as soon as the attack was identified to contain the incident and prevent further fraud.