French banking institution Crédit Mutuel Arkéa confirmed on Thursday, November 5th, that it recently fell victim to a highly unusual and complex external cyberattack. This incident has resulted in the theft of funds amounting to approximately 100 million euros (equivalent to about 112 million dollars) through fraudulent transactions.
As a significant member of the Crédit Mutuel network, a major player in the French financial services sector, Arkéa serves over 5.8 million customers and manages assets exceeding 200 billion euros. The cyberattack has sent shockwaves through the European financial community, raising concerns about the vulnerabilities within the banking sector.
The bank reported that the attack has been contained and reassured clients that their funds remain secure.
According to statements from Arkéa’s representatives, the attackers did not breach the bank’s core systems directly. Instead, they exploited the platform of a “third-party service provider” to infiltrate the bank’s systems. Once the hackers gained access to Arkéa’s internal account permissions, they initiated fraudulent transactions to transfer funds to other financial institutions. Subsequently, the stolen funds were converted into cryptocurrencies through specialized platforms.
This virtual theft has been dubbed “unprecedented” in the European banking industry and first came to light through well-known blockchain analyst ZachXBT on social media platforms. ZachXBT pointed out that illegal participants were actively converting stablecoin USDC into Ether and using multiple cryptocurrency exchange accounts for cross-chain money laundering.
Initial reports from French media outlet Le Télégramme indicated that the losses might reach as high as 133 million dollars. However, Arkéa later clarified the situation, publicly confirming that the actual amount lost is around 100 million euros. The bank emphasized that this loss is not substantial enough to affect the overall financial health and stability of the institution, which had an asset size of 212 billion euros at the end of last year and reported a net profit of 230 million euros in the first half of this year.
Arkaya also explicitly ruled out the possibility of human error contributing to the incident and clarified that its popular online banking subsidiary, Fortuneo, and customer accounts were not involved in the attack. Some of the stolen funds have already been successfully frozen with the regulatory assistance of cryptocurrency exchanges such as Kraken, and the bank is making concerted efforts to recover the remaining amounts. However, as a precautionary measure to halt trading, some customers experienced temporary delays in transaction executions.
According to reports from Reuters, the Paris public prosecutor’s office confirmed that its cybercrime unit had received a report on Wednesday and has officially initiated a criminal investigation led by the French cybercrime police, focusing on “organized groups attacking automated data processing systems.” Arkéa has also informed the European Central Bank (ECB) and the French banking regulator (ACPR) about the incident.
Cybersecurity expert Puneet Kakkar, Managing Director of Nardello & Co, noted that while the French banking sector is heavily regulated and fortified, recent security threats have intensified with the advancement of artificial intelligence (AI) tools. Notably, ZachXBT indicated that the attackers are likely not the North Korean hacking group “Lazarus Group,” which was previously involved in the 6.3 billion dollar Binance heist, based on their money laundering tactics.
Currently, French authorities and the bank’s technical teams are working closely together to determine the origins of this rare attack targeting mainstream banks. The banking community remains vigilant as they assess and enhance their cybersecurity measures in a rapidly evolving threat landscape.