- Attackers compromised an unnamed supplier and used Crédit Mutuel Arkéa’s account to make transfers.
- Crédit Mutuel Arkéa said customer accounts were not accessed and customers’ assets would not be affected.
- Crédit Mutuel Arkéa declined to confirm the estimated loss but said it could validate its order of magnitude.
Crédit Mutuel Arkéa said attackers compromised an unnamed supplier and used the banking group’s own account to make transfers to other institutions.
Crédit Mutuel Arkéa said customer accounts were not accessed and the incident would not affect customers’ assets. ZachXBT estimated losses above $133 million, while the bank said it could validate the order of magnitude but had not established the ultimate loss.
Crédit Mutuel Arkéa said the attackers reached the group through a service provider’s platform. The Record reported that the incident was first disclosed by the pseudonymous blockchain investigator ZachXBT, who later identified Arkéa as the alleged victim.
On this page
Attackers moved funds through banking and crypto platforms
Crédit Mutuel Arkéa said the attackers used its own account to send transactions to other banking institutions, potentially allowing them to convert the money into cryptocurrency through specialised platforms.
ZachXBT estimated losses above $133 million from cryptocurrency-exchange withdrawals and transactions intended to launder assets. He initially reported more than $106 million in suspicious centralized-exchange withdrawals, then raised the estimate above $133 million after finding another $27 million in withdrawals.
Bitquery traced withdrawals from accounts at Kraken, Crypto.com and OKX. It found that approximately $63 million in stablecoins were converted into Ether within four hours.
Arkéa said it took measures to contain the attack
Crédit Mutuel Arkéa said some of the converted assets had been frozen. Kraken and Crypto.com said they had restricted accounts or blocked funds associated with the suspected incident, and both exchanges said their platforms remained secure.
The loss estimate remains unconfirmed
ZachXBT said Arkéa was allegedly exploited over multiple days and warned that the total could be higher when over-the-counter activity was included.
Cointelegraph said Arkéa’s alleged involvement had not been independently verified and that ZachXBT had not disclosed how the attackers gained access to the funds. Crédit Mutuel Arkéa said the ultimate loss was not established and was not of a nature to threaten its solvency or financial health.
Crédit Mutuel Arkéa said some assets converted into cryptocurrency had been frozen and that it was working to recover the rest. It also said the incident was under control after measures were taken under existing crisis procedures.
Crédit Mutuel Arkéa said it was working with judicial and police authorities to determine the attack’s origin and modus operandi.
FAQ
What happened to Crédit Mutuel Arkéa?
Attackers compromised an unnamed supplier and used Crédit Mutuel Arkéa’s own account to send transactions to other banking institutions, potentially converting the money into cryptocurrency.
How much money did ZachXBT estimate was lost from Crédit Mutuel Arkéa?
ZachXBT estimated losses above $133 million. Crédit Mutuel Arkéa declined to confirm the figure but said it could validate the order of magnitude and that the ultimate loss had not been established.
Were Crédit Mutuel Arkéa customer accounts accessed?
Crédit Mutuel Arkéa said customer accounts were not accessed and the incident would not affect customers’ assets.
How did attackers access Crédit Mutuel Arkéa?
Crédit Mutuel Arkéa said the attackers went through the platform of one of its service providers to obtain direct access to the banking group. Cointelegraph said ZachXBT had not disclosed how the attackers gained access to the funds.
Have any funds from the Arkéa incident been recovered?
Crédit Mutuel Arkéa said some converted assets had been frozen and that it was working to recover the remainder.
Sources
How we checked this story
| Claim | Source | Status |
|---|---|---|
| The Record reported that Crédit Mutuel Arkéa confirmed it experienced a sophisticated attack after reports of an estimated $133 million theft. | The Record | Attributed |
| Crédit Mutuel Arkéa said attackers made transfers using the bank’s own account after compromising an unnamed supplier. | Crédit Mutuel Arkéa, via The Record | Attributed |
| Crédit Mutuel Arkéa said customer accounts were not accessed and the incident would not affect customers’ assets. | Crédit Mutuel Arkéa, via The Record | Attributed |
| The Record reported that ZachXBT first disclosed the incident on Monday and later named Arkéa as the alleged victim. | The Record | Attributed |
| ZachXBT estimated the theft at more than $133 million based on cryptocurrency-exchange withdrawals and transactions intended to launder assets. | ZachXBT, via The Record | Attributed |
| Crédit Mutuel Arkéa said the incident was under control after it took measures under existing crisis procedures. | Crédit Mutuel Arkéa, via The Record | Attributed |
| Crédit Mutuel Arkéa said attackers accessed the banking group through a service provider’s platform. | Crédit Mutuel Arkéa, via The Record | Attributed |
| Crédit Mutuel Arkéa described the hack as sophisticated and said it was not caused by human error. | Crédit Mutuel Arkéa, via The Record | Attributed |
| Crédit Mutuel Arkéa said attackers used its account to send transactions to other banking institutions, potentially converting the money into cryptocurrency. | Crédit Mutuel Arkéa, via The Record | Attributed |
| Crédit Mutuel Arkéa said some converted assets had been frozen and that it was working to recover the remainder. | Crédit Mutuel Arkéa, via The Record | Attributed |
| Crédit Mutuel Arkéa said the ultimate loss had not been established. | Crédit Mutuel Arkéa, via The Record | Attributed |
| Crédit Mutuel Arkéa said its security systems identified suspicious activity very quickly and enabled containment measures. | Crédit Mutuel Arkéa, via The Record | Attributed |
| Crédit Mutuel Arkéa said it was working with judicial and police authorities to determine the attack’s origin and modus operandi. | Crédit Mutuel Arkéa, via The Record | Attributed |
| ZachXBT identified Crédit Mutuel Arkéa as the alleged victim of a crypto theft exceeding $133 million. | ZachXBT, via Cointelegraph | Attributed |
| ZachXBT suspected the amount stolen was larger when over-the-counter activity was included. | ZachXBT, via Cointelegraph | Attributed |
| Cointelegraph reported that Arkéa’s alleged involvement had not been independently verified and that ZachXBT had not disclosed how access was obtained. | Cointelegraph | Attributed |
| ZachXBT initially reported more than $106 million in suspicious centralized-exchange withdrawals on Monday. | ZachXBT, via Cointelegraph | Attributed |
| ZachXBT raised the estimated losses above $133 million on Tuesday after finding another $27 million in withdrawals. | ZachXBT, via Cointelegraph | Attributed |
| Bitquery traced withdrawals from accounts at Kraken, Crypto.com and OKX. | Bitquery, via Cointelegraph | Attributed |
| Bitquery found that approximately $63 million in stablecoins were converted into Ether within four hours. | Bitquery, via Cointelegraph | Attributed |
| Kraken and Crypto.com said they restricted accounts or blocked funds associated with the suspected theft. | Kraken and Crypto.com, via Cointelegraph | Attributed |
| Kraken and Crypto.com said their platforms remained secure. | Kraken and Crypto.com, via Cointelegraph | Attributed |
Could not verify
- Whether the attackers’ identity or origin is established is not established
- Whether the incident involved exploitation of a specific software vulnerability is not established
Related stories
Data LeaksAt least a dozen AI developer platforms hit in attacks seeking AI access tokens
Data LeaksArara email service breach exposed more than 1 million Osaka addresses
Data LeaksMaersk data extraction from acquired legacy system under investigation