Crédit Mutuel Arkéa confirmed on November 4 that it had suffered a cyberattack that enabled fraudulent transfers. The group, which has more than 5.8 million members and customers, said the attackers accessed its systems through a platform belonging to one of its service providers and used an Arkéa account to move funds to other banks. The incident did not involve its digital bank Fortuneo, the group said.
Blockchain investigator ZachXBT estimated that more than $133 million, or around €118 million, had been stolen. Arkéa told Reuters that its losses would be lower, but had not yet provided a final figure. ZachXBT first reported suspicious transactions on November 2 and later identified Arkéa as the institution involved.
The scale of the transfers is still unclear. ZachXBT initially identified withdrawals exceeding $106 million and later found another $27 million. Separately, blockchain analytics firm Bitquery tracked $108.8 million in USDC transfers across 15 cryptocurrency addresses over roughly 21 hours. Bitquery said it could not identify the account holders or verify the total amount reported.
Bitquery traced withdrawals from accounts at Kraken, Crypto.com and OKX, with much of the money later converted into ether. Tether froze about $1.14 million in USDT, while Crypto.com told CoinDesk it had blocked further movement of funds connected to the incident. It remains unknown how much money can be recovered.
Arkéa said customers’ funds remained protected because the attackers used an account belonging to the group, rather than customer accounts. The bank reported delays to some transfers, but said nearly all operations were functioning again by the morning of November 4. It also warned customers about possible phishing attempts related to the incident.
Sources: Xataka.