Credit Mutuel Arkea Confirms Cyberattack; ZachXBT Estimates Losses Over $133M

On Wednesday, Credit Mutuel Arkea, a French bank, confirmed a cyberattack enabled fraudulent transfers from its own account. On-chain investigator ZachXBT estimates the theft at over $133 million, though the bank has not verified that figure.

The lender, based in Brittany, stated the incident is under control, operations are resuming, and customer assets remain unaffected. As a precaution, it suspended certain transactions.

The bank stated on its website, via a translation published by Reuters: "This incident has had no impact on (customer) assets and has only caused a delay in the execution of certain transfers."

In a subsequent Q&A note, Credit Mutuel Arkea explained that the attackers accessed the bank directly via a service provider's platform. They used the bank's own account to initiate transfers to other banks, which may have enabled them to convert the funds into cryptocurrency through specialized platforms, according to the bank.

The bank stated that no customer accounts at its federations or subsidiaries were involved. It rejected French media reports that the breach occurred via Fortuneo, its online banking unit, describing the attack as "a sophisticated attack from the outside" rather than a human error.

Scale of the Credit Mutuel Arkea Hack

The bank has yet to provide a final number. When asked if 118 million euros ($133 million) was taken, it said it cannot confirm that figure but can only "validate the order of magnitude."

The bank noted that some of the funds have been frozen and additional measures are being taken to recover the remainder. It added that the sums involved are "absolutely not" sufficient to jeopardize its financial stability or soundness.

AFP reported that the bank's provisional estimate placed the attack at roughly 100 million euros. Earlier on Wednesday, Reuters reported that the bank stated its losses were less than $133 million. "It is still too early to give a final figure," a spokesperson told the wire service.

ZachXBT's Findings

ZachXBT initially flagged the incident on Monday without identifying the victim. On his Telegram channel, he wrote that an EU entity was believed to have lost over $106 million from several centralized exchange accounts on Nov. 1, with the funds taken out as USDC and USDT. He added that the funds were subsequently exchanged for ether and transferred across multiple chains.

In an update, he reported finding an additional $27 million or more in exchange withdrawals, raising the total to over $133 million. A subsequent post identified Credit Mutuel Arkea as the alleged victim. He wrote that the attack "occurred for multiple days" and suspects the actual amount stolen is higher when over-the-counter activity is considered.

The bank has not corroborated his estimate or timeline. It has also not disclosed when the attack started, who was responsible, or if any data was stolen. Credit Mutuel Arkea is collaborating with judicial and police authorities to investigate the origin and execution of the attack. It stated that it notified its supervisors upon detecting the breach.

The bank additionally cautioned customers about potential phishing attempts following the Credit Mutuel Arkea hack.

Credit Mutuel Arkea, which encompasses the Credit Mutuel federations of Brittany and the Southwest, is part of the larger Credit Mutuel group. According to Reuters, it has 5.8 million clients and assets of 211.5 billion euros ($238 billion). AFP reported that it posted a net profit of 230 million euros in the first half of the year.

The Credit Mutuel Arkea hack comes less than a week after the record $6.34 billion Binance hack, which blockchain analysis firms have attributed to North Korea. In his initial post, ZachXBT expressed high confidence that this incident was not carried out by North Korea's Lazarus Group. Brazil's Mercado Bitcoin also suspended deposits and withdrawals this week following a security incident.

How much of the funds the bank can recoup, and the ultimate loss from the Credit Mutuel Arkea hack, remains uncertain.