Crédit Mutuel Arkéa hit by $133M cyberattack via service provider

French cooperative bank Crédit Mutuel Arkéa was targeted in a sophisticated cyberattack that facilitated fraudulent transactions of up to $133 million. The incident forced the financial institution to temporarily suspend certain operating systems to mitigate the threat.

• The attacker breached the bank's network via a third-party service provider's platform.
• Unauthorized transactions reached up to 118 million euros ($133 million).
• Customer assets remained entirely unaffected as the attacker utilized the bank's own corporate accounts.
• Stolen funds were quickly laundered and withdrawn into USDC and USDT stablecoins.

Details of the Incident and Discovery

Reports about the security breach surfaced on November 2, initially raised by blockchain investigator ZachXBT, who flagged large-scale unauthorized withdrawals from centralized exchange accounts. According to the investigator, the attacker stole up to 118 million euros and cashed it out into USDC and USDT. The lack of immediate public disclosure allowed the attacker to launder $30 million before law enforcement agencies could freeze the assets.

Crédit Mutuel Arkéa publicly disclosed the security incident on November 4, assuring its customer base that the situation was fully under control and operations were gradually normalizing. The bank confirmed that client assets experienced zero direct impact, with the breach only causing delays in processing certain transfer transactions.

Attack Vector and Ongoing Investigation

In an accompanying FAQ page, the bank clarified that the malicious actor accessed its corporate network directly through a service provider's platform while explicitly ruling out Fortuneo. Instead of targeting customer funds, the attacker leveraged Arkéa's own accounts to transact with external banking institutions and convert capital into cryptocurrency.

While the bank did not formally validate ZachXBT's specific financial estimate, it acknowledged that the magnitude of the affected funds was substantial and confirmed that some assets had been successfully blocked. Arkéa dismissed any internal human error, categorizing the event as a sophisticated attack, and is currently cooperating closely with judicial authorities and law enforcement.

Implications for the Financial Sector

As a major French banking group boasting over 5.8 million members and 211.5 billion euros in assets, the incident highlights critical vulnerabilities tied to supply chain and third-party vendor integrations. The bank has also issued strong warnings regarding heightened phishing risks, advising customers to remain vigilant against unsolicited communications and verify suspicious requests directly through official channels.