Crédit Mutuel Arkéa confirms attack enabled fraudulent transfers

Crédit Mutuel Arkéa has said it was the victim of an attack described as enabling fraudulent transactions to be carried out, with the bank stating the incident involved access to its network via a service provider’s platform. In an FAQ, the group explained that attackers used Arkéa’s own account to make transfers to other banking institutions, which could then be converted into cryptocurrency via specialised platforms.

The bank stressed that customer accounts of federations or subsidiaries were not used and that there are no financial consequences for customers. It added that once the attack was identified, security measures were activated to contain the incident and prevent further fraudulent activity.

The incident initially came to light on 2 November when blockchain investigator ZachXBT claimed in a Telegram post that an unnamed “EU entity” had lost about $106m from multiple centralised exchange accounts, with a follow-up note suggesting an additional $27m.

ZachXBT said the illicit actor was liquidating assets across networks and exchanges, and speculated the breach involved a large Western European financial institution being covered up, though Crédit Mutuel Arkéa said it was still early to determine the full financial impact. The bank noted some funds had been frozen and other steps were underway to recover them, and it urged customers to be vigilant for phishing in the aftermath.