Crédit Mutuel Arkéa confirmed on Wednesday, November 4, that it was the victim of a Cyberattack enabling fraudulent operations. The admission follows days of speculation on social media initiated by independent blockchain investigator ZachXBT. On Monday, November 2, ZachXBT reported over $106 million in withdrawals from an unidentified European entity via his Telegram channel. By Tuesday, this estimate had risen to more than $133 million before the investigator specifically identified Crédit Mutuel Arkéa as the target.
Specialized journalist Grégory Raymond subsequently detailed on X that funds were allegedly withdrawn from the bank and transferred to multiple accounts on cryptocurrency exchange platforms. According to Raymond's account, the attackers converted traditional currency into cryptocurrencies to launder the money. However, the bank has not officially confirmed the $133 million figure, which equates to approximately 118 million euros, nor has it disclosed the specific method used or the identity of the perpetrators.
Upon detecting the breach, Arkéa suspended certain transactions to prevent further fraudulent movements. Regional daily Le Télégramme noted that some transfers were impossible within the bank's applications on Wednesday, though the group promises a rapid resumption of services once final checks are completed. The bank asserts that the incident is now under control and guarantees that its clients will suffer no financial consequences.
The Arkéa group comprises the Crédit Mutuel federations of Brittany and South-West France and includes subsidiaries such as Fortuneo. It operates separately from Crédit Mutuel Alliance Fédérale, the other major entity within the Crédit Mutuel network. While the two groups remain solidary, Crédit Mutuel Alliance Fédérale clarified to Numerama that their information systems are distinct, confirming that only Arkéa was targeted in this attack.
Sources: Numerama.