Credit Mutuel Arkea Confirms Cyberattack; Losses Reported at $133M Remain Unverified
French bank Credit Mutuel Arkea confirmed a cyberattack that enabled fraudulent transfers from its own account, but has not confirmed the $133 million loss figure reported by on-chain investigator ZachXBT. The bank says customer assets were unaffected and that some funds have been frozen while recovery efforts continue.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What the Bank Has Confirmed
Credit Mutuel Arkea said on November 4 that hackers used its own account to make fraudulent transfers, and that the incident has been brought under control. The bank said customer assets were not affected and that the only effect on customers was a delay in some transfers, which it suspended as a precaution before resuming operations.
According to a follow-up note from the bank, attackers entered through the platform of an unnamed third-party service provider and then reached the bank directly. The bank described the intrusion as "a sophisticated attack from the outside" and rejected French press reports that the entry point was Fortuneo, its online banking arm, as well as suggestions that employee error was involved.
The Disputed Loss Figure
The size of the theft is where the sources diverge. On-chain investigator ZachXBT first flagged the incident on Monday without naming the victim, saying an EU entity had lost more than $106 million from centralized exchange accounts on November 1, with the funds withdrawn as USDC and USDT. He later added at least $27 million in further exchange withdrawals, bringing his total to more than $133 million, and named Credit Mutuel Arkea as the alleged victim. He said the attack "occurred for multiple days" and that the true figure could be higher once over-the-counter activity is counted.
The bank has not confirmed that number. Asked whether 118 million euros, or $133 million, had been stolen, it said it "does not confirm this information" and can only "validate the order of magnitude." Reporting on the bank's own estimate also varies. AFP reported a provisional figure of about 100 million euros, while Reuters reported that the bank said its losses were lower than $133 million. A bank spokesperson told Reuters that "it is still too early to give a final figure." The sources therefore do not agree on the amount, and no source has an audited or final number.
Movement of Funds and Recovery
The bank said the attackers sent transactions to other financial institutions, which may then have allowed the money to be converted into cryptocurrency through specialized platforms. It did not confirm that any crypto purchases took place, and did not name platforms, digital assets or wallet addresses. ZachXBT said the funds were swapped for ether and moved across several chains, a detail the bank has not addressed.
Part of the funds has been frozen, and the bank says it is pursuing recovery of the remainder. It did not disclose how much has been secured. The bank also said the amounts involved are "absolutely not" large enough to threaten its financial health. It reported 211.5 billion euros in assets and 230 million euros in net profit for the first half of the year, and it has told customers to be alert to possible phishing. The Paris public prosecutor's office has opened an investigation into an alleged attack on an automated data-processing system by an organized group, and the bank is working with judicial and police authorities. The bank has not said when the attack began, who was responsible, or whether any data was taken.
Wider Context
The incident follows a $6.34 billion Binance hack that blockchain analysis firms have linked to North Korea. ZachXBT said he was highly confident this incident was not the work of North Korea's Lazarus Group. Brazil's Mercado Bitcoin also froze deposits and withdrawals this week after a separate security incident. How much the bank recovers, and what its final loss will be, remains unresolved.
Why It Matters
For Traders
Reported on-chain flows of USDC, USDT and ether tied to the theft may affect liquidity and stablecoin tracing, but the loss figure remains unconfirmed and should be treated as provisional.
For Investors
A large theft at a regulated bank that reaches crypto markets underscores counterparty and custody risk, and regulators may scrutinize the exchange and off-ramp channels involved.
For Builders
The entry point through a third-party service provider highlights supply-chain risk, so teams should audit vendor access paths to banking and treasury systems, not only their own perimeter.
This article is for information only and is not financial advice. Read the full disclaimer.
