Four Ethereum addresses, a reported $133 million and an unnamed service provider sit at the center of the Crédit Mutuel Arkéa breach. The French bank confirms fraudulent transfers. Much of the cryptocurrency account remains an investigator’s reconstruction, not a loss figure endorsed by the lender.
Asked about reports of €118 million ($133 million), Arkéa answered: “We do not confirm this information and can only validate the order of magnitude.” Some money has been blocked, while recovery work continues.
The way in
On November 4, the Brittany-based banking group said intruders entered through an external provider’s platform. They then initiated transfers from accounts belonging to the bank to other financial institutions.
Customer accounts were not used, Arkéa said, and clients would bear no financial losses. It also rejected suggestions that Fortuneo, its online banking subsidiary, supplied the entry point. The provider has not been named, nor has the bank explained the weakness exploited.
The institution called the incident a “sophisticated attack from outside,” rather than an employee error. Staff briefly halted certain transactions while adding controls and checking systems. Nearly all affected operations were running again that morning, although some customers had experienced delayed transfers.
What the chain shows
ZachXBT, an independent blockchain investigator, initially flagged suspicious exchange withdrawals above $106 million. He subsequently attributed another $27 million in withdrawals to the attacker, taking his estimate beyond $133 million.
His account describes USDC and USDT withdrawals, swaps into ETH, movement through instant exchanges and bridges across several chains. Part of the money entered a privacy coin. He suspects over-the-counter activity would raise the total further.
Bitquery separately followed approximately $108.8 million in USDC withdrawals involving Kraken, Crypto.com and OKX accounts between November 1 and November 2. That firm explicitly cautioned that blockchain records cannot by themselves prove a connection between those withdrawals and Arkéa.
Crypto.com said it blocked funds linked to the suspected incident. OKX froze an institutional account after spotting unusual activity. Both said other customer accounts were unaffected.
A dispute over disclosure
ZachXBT published four Ethereum addresses he connected to the theft. He also argued that slower public disclosure hindered law enforcement’s ability to freeze about $30 million. The bank has not confirmed that all the transactions he identified were tied to its systems.
The suspected thief remains unidentified. ZachXBT said laundering indicators gave him “a high degree of confidence it is NOT Lazarus Group,” distinguishing this case from the North Korean collective.
Arkéa had already been preparing a cryptocurrency business. L’Agefi reported in May that it sought a MiCA license to sell crypto services to retail clients and offer white-label services through Arkéa Banking Services.
The banking investigation
Paris prosecutors are examining an alleged organized attack on an automated data-processing system. Arkéa notified supervisory and law-enforcement authorities after detecting the intrusion.
The bank says the incident is “closed and now under control,” with no threat to its financial health. It reports €211.5 billion in assets, approximately 40 specialized subsidiaries and a combined membership and customer base exceeding 5.8 million.
Customers now face a separate warning. Criminals may exploit publicity around the attack with phishing messages seeking login details, passwords, card numbers or SMS validation codes. Arkéa has reported no confirmed theft of customer data and advises recipients of suspicious messages to contact their banking adviser directly.
Arkéa has not supplied a final loss figure.
Sources
- Crédit Mutuel Arkéa Confirms Cyberattack Amid $133M Reports
- Crédit Mutuel
- French bank Arkéa reports cyberattack, says customers face no loss
- Crédit Mutuel Arkéa Confirms Cyberattack After ZachXBT Ties It to $133M Crypto Theft – Decrypt
- Crédit Mutuel Arkéa said hackers stole money in a cyberattack
- French bank Crédit Mutuel Arkéa hit by $133M cyberattack, funds may have moved to crypto
Photo: FJaffres (CC BY-SA 4.0)
