Crédit Mutuel Arkéa hit by cyberattack, about €118M reportedly stolen

Funds moved into crypto

Onchain investigator ZachXBT flagged the case first. On Sunday he reported withdrawals of more than $106 million in USDC and USDT from an unidentified European entity, then raised his estimate to $133 million on Tuesday. Some withdrawals occurred after his first alert.

According to journalist Grégory Raymond, the attack targeted Fortuneo, Arkéa's online bank. Fraudsters allegedly issued transfers while choosing the beneficiary name themselves, sending money to accounts opened with false identities on platforms such as Kraken, OKX and Crypto.com. A source close to the case described traditional currency being cashed out and converted to crypto, using a network of "mule" accounts.

ZachXBT's analysis suggests the stablecoins were swapped for ETH, routed through instant-exchange services (WellWallet, Kyrrex), then exchanged for Monero (XMR), designed to make transactions untraceable. He rules out North Korea's Lazarus group "with a high degree of confidence" and estimates more than $30 million could have been frozen had the incident been reported quickly. Arkéa told the journalist it could not confirm the information on Tuesday evening.

Impact on customers

The bank says customers' interests are "fully protected". Individual accounts do not appear to be affected, but some transactions were suspended as a precaution. The banking app has displayed an error message for several hours and transfers are impossible. Arkéa told AFP that services will resume quickly once final security checks are complete.

As after any high-profile breach, scammers are likely to exploit the situation. Customers should be wary of calls, texts or emails from supposed advisers mentioning the hack, and never share banking codes.