Crédit Mutuel cyberattack linked to $133 million theft

A Crédit Mutuel cyberattack allowed an attacker to initiate fraudulent transfers from Arkéa’s own bank account after gaining access through a service provider. Estimates put the theft at €118 million, approximately $133 million, although the French banking group has not confirmed that exact amount.

Attacker accessed the bank through a provider

Crédit Mutuel Arkéa said the attacker entered its network through a service provider’s platform. From there, the intruder used an account belonging to the bank to transfer money to other financial institutions and convert funds into cryptocurrency. However, the bank said the attacker did not use customers’ accounts.

The group, which serves more than 5.8 million members and holds €211.5 billion in assets, suspended certain systems in response. Consequently, some customers experienced delays when making transfers. The bank nevertheless maintained that the incident had no impact on customer assets.

In a separate explanation, Arkéa ruled out Fortuneo as the platform involved. It also rejected human error within the bank as the cause, describing the intrusion as a sophisticated attack. However, it has not publicly established the precise method the attacker used.

Investigator tracked suspicious cryptocurrency withdrawals

Blockchain investigator ZachXBT first raised concerns on November 2 about large unauthorized withdrawals from several centralized cryptocurrency exchange accounts the previous day. Although he initially left the affected organization unnamed, he estimated that the attacker had taken up to €118 million and withdrawn funds as USDC and USDT stablecoins.

By November 3, ZachXBT claimed the attacker had laundered $30 million. He also argued that earlier public disclosure could have helped European law enforcement freeze those funds. These figures and that assessment came from the investigator, rather than confirmation from the bank.

Arkéa subsequently acknowledged that the amount involved was significant and broadly consistent with the reported scale. Nevertheless, it declined to validate the exact €118 million estimate. The bank also said it had blocked some funds, without specifying how much.

Crédit Mutuel cyberattack prompts phishing warning

Arkéa publicly disclosed the incident on November 4, saying it had contained the attack and was gradually restoring normal operations. Meanwhile, it warned customers that criminals could exploit the situation through phishing messages or unsolicited calls.

The bank urged customers to avoid sharing sensitive information by phone or email. Instead, anyone receiving a suspicious message should contact their bank adviser directly to check its authenticity. Such precautions address follow-up fraud risks, even though the bank says customer assets remain unaffected.

Arkéa is working with police and judicial authorities to determine the attack’s origin and reconstruct how it happened. The exact financial loss, the amount successfully blocked and the full technical details remain unclear.