French lender Credit Mutuel Arkea said a Cyberattack enabled hackers to make fraudulent transfers from the bank’s own account. On-chain investigator ZachXBT estimates that more than $133 million was stolen, but the bank has not confirmed that figure and says it is too early to establish a final loss.
The bank said the incident was under control, operations were resuming and customer assets were not affected. Some transfers were temporarily suspended as a precaution. Credit Mutuel Arkea said the attack caused delays in certain transactions, rather than losses to customer accounts.
According to the bank, attackers reached it through a service provider’s platform and used its account to send money to other banks. Those transfers may have allowed the funds to be converted into cryptocurrency through specialist platforms. The bank said no accounts belonging to customers of its federations or subsidiaries were used.
Credit Mutuel Arkea described the incident as a sophisticated external attack and rejected French media reports that the attackers entered through Fortuneo, its online banking arm. It has not disclosed when the attack began, who was responsible or whether any data was taken. The bank is working with judicial and police authorities to investigate and said it notified its supervisors after detecting the attack.
The bank has declined to confirm a reported figure of 118 million euros, or about $133 million, saying it can validate only the order of magnitude. It said some of the funds have been frozen and that efforts are underway to recover the remainder. AFP reported a provisional estimate of around 100 million euros, while Reuters reported that the bank had said its losses were below $133 million.
ZachXBT first reported the incident on Monday without identifying the institution. He said an EU entity was suspected of losing more than $106 million from withdrawals across several centralized exchange accounts on Nov. 1. The funds were reportedly withdrawn as USDC and USDT, exchanged for ether and moved across multiple chains. In a later update, he cited at least another $27 million in exchange withdrawals, putting his estimate above $133 million, and named Credit Mutuel Arkea as the alleged victim. The bank has not confirmed his estimate or timeline.
Credit Mutuel Arkea also warned customers to be alert to possible phishing attempts following the attack.
Sources: Bitcoin Magazine.