Crédit Mutuel Arkéa confirms heist estimated above $133 million
French bank Crédit Mutuel Arkéa has officially confirmed a sophisticated attack: intruders accessed a supplier's platform and used the bank's own account to transfer funds to other institutions, later converted into cryptocurrency. Investigator ZachXBT estimates more than $133 million stolen; the bank says it can validate the order of magnitude, some converted assets have been frozen and customer accounts were not accessed. The bank says the incident is under control and it is working with judicial and police authorities to determine the origin.
What happened
French banking group Crédit Mutuel Arkéa has officially confirmed a sophisticated attack. After compromising the platform of a service provider, attackers used the bank's own account to transfer funds to other financial institutions, later converted into cryptocurrency. Investigator ZachXBT estimates more than $133 million stolen; the bank says it can validate the order of magnitude.
Why it matters
The bank says customer accounts were not accessed and customers will suffer no losses; the ultimate loss is not yet established but does not threaten the group's solvency, with total assets above 237 billion, according to its annual report cited by The Record. ZachXBT says the delay in disclosure allowed more than $30 million in stolen funds to be laundered, money EU authorities could have frozen. The case exposes the risk of suppliers with direct access to core payment operations.
What to do
Urgently review supplier access to payment platforms, monitor unusual transfers in real time, and keep fast coordination channels with exchanges and stablecoin issuers to freeze funds. In Arkéa's case, the bank says it blocked the fraudulent transactions and contained the attack.
For the technical team
- Affected
- Crédit Mutuel Arkéa, grupo bancário francês; fundos teriam seguido para contas em corretoras de criptomoedas, incluindo a Crypto.com · Crédit Mutuel Arkéa, French banking group. French media point to online banking subsidiary Fortuneo as the entry point, which the bank disputes.
- Exploitation
- Attack confirmed by the bank itself. ZachXBT reported withdrawals of more than $106 million in USDC and USDT, on Sunday, from an unidentified European entity, and raised the estimate to more than $133 million on Tuesday after finding another $27 million in exchange withdrawals. No group has claimed the attack. Some of the converted assets have been frozen, according to the bank.
- Fix
- No software fix applicable. The bank says it identified the suspicious activity quickly, contained the attack and blocked fraudulent transactions, and is working with judicial and police authorities to determine the origin and modus operandi and recover the remaining funds.
- Vector
- Compromise of a service provider's platform, which gave direct access to the banking group, according to the bank. The attackers then used Crédit Mutuel Arkéa's own account for transfers to other institutions, converted into cryptocurrency on specialised platforms. The bank calls the attack sophisticated, rules out human error and disputes French media reports that entry came through subsidiary Fortuneo. A source cited by journalist Grégory Raymond raises two hypotheses: compromise of payment systems, invisible for days, or internal human failure, a variant of the president scam run by a francophone network.
- More details
- ZachXBT says the lack of disclosure allowed more than $30 million in stolen funds to be laundered that EU authorities could have frozen; part of the withdrawals happened after his first alert. A source close to the case told Grégory Raymond that fiat left the bank and was later converted to crypto, a procedure described as unprecedented, run with mule accounts opened with false identities that passed KYC, first on Kraken. The Record reports ZachXBT broke the story on Monday and the bank issued its statement on Wednesday evening; the bank says the ultimate loss is not established and does not threaten its solvency.
Timeline
The bank confirms the attack and says intruders entered through a supplier's platform and used Arkéa's own account to move the funds to other financial institutions.
Bank officially confirms the heist: transfers were made from the bank's own account after an unnamed supplier was compromised.
Bank confirms intrusion with fraudulent transactions and an unspecified amount; no group has claimed the attack so far.
Want the next updates in your inbox? Get the daily edition →
See all 12 updates
Bank says it blocked fraudulent transactions and the attack is now contained; reported loss is €118 million, still unconfirmed by the bank.
A widely shared post reports the Crédit Mutuel Arkéa breach and theft of an undisclosed amount via fraudulent transactions, adding no new details to the case.
Bank takes its app offline, blocks all transfers and says customers will lose nothing.
ZachXBT traces $108.8 million in USDC withdrawn from Kraken, Crypto.com and OKX accounts over 21 hours, then converted to ETH to avoid stablecoin freezes.
The bank officially confirms the breach and losses above $133 million in crypto, previously reported only by third-party analyses.
New sources combined with on-chain analysis reconstruct the money trail and suggest losses may exceed the initial $133 million.
Reporting on the case names Crédit Mutuel Arkéa as the victim and says funds went to exchanges including Crypto.com.
ZachXBT says the lack of proper disclosure allowed over $30 million in stolen funds to be laundered, money EU authorities could have frozen.
Incident opened.
Sources 12 sources
- @DegenerateNews @DegenerateNews
- @TheBlockCo @TheBlockCo
- @gregory_raymond @gregory_raymond
- @gregory_raymond @gregory_raymond
- @wmiddelkoop @wmiddelkoop
See all 13 sources
- @AshCrypto @AshCrypto
- @CoinDesk @CoinDesk
- @WhaleScan @WhaleScan
- @Polymarket @Polymarket
- @MarioNawfal @MarioNawfal
- @hoje_no @hoje_no
- French bank confirms cyber heist, hackers suspected to have stolen an estimated $133 million The Record
- @DarkWebInformer @DarkWebInformer
