Crédit Mutuel Arkéa hit by cyberattack: over €100M stolen via vendor

Attackers came through a supplier

Speaking to AFP, the bank said the attackers "went through the platform of one of our service providers", whose identity has not been disclosed. They then used Arkéa's own account to send transfers to other banks, so the money taken was the bank's, not its customers'. Arkéa says no account belonging to its federations or subsidiaries was used, and that nothing came in through its online bank Fortuneo, contrary to early claims. It rules out internal human error and describes "a sophisticated attack from outside".

From euros to Monero

According to crypto journalist Grégory Raymond, citing several sources, the transfers landed in accounts opened under false identities on exchanges such as Kraken, OKX and Crypto.com, and were quickly swapped into stablecoins. Analytics firm Bitquery says more than $108 million in USDC was then withdrawn, mostly from Kraken, and part was converted to ether overnight between 1 and 2 November. Investigator ZachXBT, who spotted the attack first, says some funds went through instant-swap services before being converted to Monero, whose transactions hide sender, recipient and amount.

Arkéa says part of the funds were blocked and further steps are under way; CoinDesk reports that Crypto.com froze funds linked to the case. ZachXBT rules out North Korean actors.

After a complaint from the bank, the Paris prosecutor's cybercrime section opened an investigation into organised-gang interference with an automated data processing system, led by the OFAC cybercrime office. The Banque de France has been informed. Open questions include the supplier's name, the flaw exploited, the exact loss, and how large transfers spread over several days escaped the bank's alert systems. ZachXBT raised the alarm over the weekend, three days before the announcement.