Crédit Mutuel Arkéa reports $133 million cyberattack via service provider

Cyberattack on French Bank

Crédit Mutuel Arkéa, a major French cooperative bank, was subjected to a cyberattack that led to fraudulent transactions potentially totaling $133 million. The incident prompted the bank to temporarily suspend certain systems as a precautionary measure.

Attack Vector and Impact

The attacker gained access to the bank's network through a service provider's platform, then used Crédit Mutuel Arkéa's own account to initiate transactions to other banking organizations. These funds were subsequently converted into USDC and USDT stablecoins. The bank confirmed that customer assets were not directly impacted, but acknowledged the significant amount involved and that some funds were blocked.

Bank's Response and Disclosure

Reports of the incident first surfaced on November 2 from blockchain fraud investigator ZachXBT, who estimated the stolen amount. Crédit Mutuel Arkéa officially disclosed the attack on November 4, stating the incident was "closed and under control" and operations were gradually returning to normal. The bank also issued a warning to customers about an increased risk of phishing.

Nature of the Attack

Crédit Mutuel Arkéa described the event as a "sophisticated attack," ruling out internal human error. The bank did not confirm the exact $133 million figure but validated the order of magnitude. The incident highlights the vulnerabilities that can arise from third-party service providers in financial institutions.