Attackers steal up to €118 million from French bank Arkéa

Crédit Mutuel Arkéa disclosed that a cyberattack leveraged a service provider to move fraudulent transfers from the bank’s own account to other financial institutions, with the bank indicating that customer assets were not affected and that operations were gradually resuming after containment. The incident led Arkéa to suspend some systems and delay certain transfers, and the bank has said it is cooperating with authorities as the investigation proceeds. Arkéa’s public notice emphasised that the attack was detected under normal procedures and that enhanced security measures are being implemented.

Based on third-party analysis linked to the event, the attacker is reported to have stolen up to around €100 million (approx. US$112.6 million), with later estimates cited by the security researcher ZachXBT suggesting as much as €118 million (about US$133 million).

According to ZachXBT, the funds were moved through a sequence of steps, including swapping USDC for ETH, transferring to various instant exchanges, converting to XMR via Wagyu, and bridging across multiple chains; he also stated that, in his view, the suspect is unlikely to be Lazarus Group. Arkéa has not confirmed the higher figure and noted that some funds were blocked, while stating that the incident is now closed and under investigation by France’s cybercrime unit with the Paris prosecutor’s office.

Reuters reported Arkéa’s preliminary stance that the attack involved the bank’s own account and affected transfers rather than customer assets.