Bitcoin Magazine
French Bank Credit Mutuel Arkea Confirms Cyberattack as ZachXBT Puts Losses Above $133 Million
French bank Credit Mutuel Arkea said Wednesday that a cyberattack allowed hackers to carry out fraudulent transfers from the bank’s own account, a theft that on-chain investigator ZachXBT has put at more than $133 million and that the bank has not confirmed.
The Brittany-based lender said in a statement that the incident was under control, that operations were resuming and that customer assets were not affected. It suspended some transactions as a precaution.
“This incident has had no impact on (customer) assets and has only caused a delay in the execution of certain transfers,” the bank said on its website, in a translation published by Reuters.
In a follow-up question-and-answer note, Credit Mutuel Arkea said the attackers went through the platform of one of its service providers and reached the bank directly. They used the bank’s own account to send transactions to other banks, which then potentially allowed them to convert the money into cryptocurrency through specialized platforms, the bank said.
No customer accounts at its federations or subsidiaries were used, the bank said. It denied French press reports that the attackers got in through Fortuneo, its online banking arm, and said the Credit Mutuel Arkea hack was “a sophisticated attack from the outside,” not the result of human error.
The size of the Credit Mutuel Arkea hack
The bank has not given a final figure. Asked whether 118 million euros, or $133 million, had been stolen, it said it does not confirm the number and can only “validate the order of magnitude.”
Part of the funds involved has been frozen and other steps are underway to recover the rest, the bank said. It added that the amounts at stake are “absolutely not” large enough to threaten its financial health or soundness.
AFP reported that the bank put the attack at about 100 million euros in a provisional estimate. Earlier Wednesday, Reuters reported that the bank said its losses were lower than $133 million. “It is still too early to give a final figure,” a spokesperson told the wire service.
What ZachXBT reported
ZachXBT first flagged the incident on Monday without naming the victim. He wrote on his Telegram channel that an EU entity was suspected of losing more than $106 million from multiple centralized exchange accounts on Nov. 1, with the funds withdrawn as USDC and USDT. He said the funds were then swapped for ether and moved across several chains.
In an update, he said he had found another $27 million or more in exchange withdrawals, bringing the total to more than $133 million. A later post named Credit Mutuel Arkea as the alleged victim. He wrote that the attack “occurred for multiple days” and that he suspects the amount stolen is larger once over-the-counter activity is counted.
The bank has not confirmed his figure or his timeline. It has also not said when the attack began, who was behind it or whether any data was taken. Credit Mutuel Arkea is working with judicial and police authorities to determine the origin of the attack and how it was carried out. It said it informed its supervisors once the attack was detected.
The bank also warned customers that phishing attempts are possible after the Credit Mutuel Arkea hack.
Credit Mutuel Arkea, which groups the Credit Mutuel federations of Brittany and the Southwest, is part of the wider Credit Mutuel group. It has 5.8 million clients and 211.5 billion euros, or about $238 billion, in assets, Reuters reported. It posted net profit of 230 million euros in the first half of the year, AFP reported.
The Credit Mutuel Arkea hack lands less than a week after the record $6.34 billion Binance hack, which blockchain analysis firms have linked to North Korea. ZachXBT said in his first post that he was highly confident this incident was not the work of North Korea’s Lazarus Group. Brazil’s Mercado Bitcoin also froze deposits and withdrawals this week after a security incident.
How much of the money the bank can recover, and what the final loss from the Credit Mutuel Arkea hack will be, remains open.
This post French Bank Credit Mutuel Arkea Confirms Cyberattack as ZachXBT Puts Losses Above $133 Million first appeared on Bitcoin Magazine and is written by Micah Zimmerman.