Crédit Mutuel Arkéa cyberattack: $133M traced to crypto

Crédit Mutuel Arkéa, a French cooperative banking group based in Brittany, said on 4 November that it had been hit by an attack that "allowed fraudulent transactions", that the incident was under control and that its customers would suffer no financial loss, franceinfo and Euronews reported. It suspended some transactions as a precaution and has not said how much was taken. It told Le Parisien that some funds had been frozen and the amount was still being assessed, according to Euronews. Customers reported that the banking app was unavailable on Wednesday morning, and its online bank Fortuneo told customers that instant transfers were disrupted.

The bank's statement came after ZachXBT named it. ZachXBT is a pseudonymous, independent blockchain investigator who traces crypto thefts and regularly works with law enforcement, BFM reported; his findings are his own analysis of public blockchain data, not an official finding. On 2 November he reported that an unnamed EU entity had lost more than $106 million the day before from several accounts on centralised crypto exchanges, withdrawn as the stablecoins USDC and USDT. Early on 4 November he raised the total to more than $133 million after finding $27 million in further withdrawals, part of them made after his first alert, and named Crédit Mutuel Arkéa.

How the money left

The stolen money was not crypto held by the bank. According to French journalist Grégory Raymond, who pieced the route together from sources and blockchain data, the fraudsters sent transfers out of Fortuneo to exchange accounts that organised networks had opened under fake identities, starting with Kraken. Each transfer carried the exact name of the exchange account's holder, so it passed the checks that match sender and account owner. Kraken has said its systems were not compromised and no customer accounts were taken over, Raymond reports.

On the exchanges the euros were turned into stablecoins and withdrawn, the first from OKX at 12:25 UTC on 1 November and the next from Kraken 44 minutes later, Raymond writes, citing tracing by Bitquery. Overnight into 2 November about $63 million in stablecoins was swapped for ETH, which no issuer can freeze, according to Raymond. ZachXBT says the actor then moved funds through instant exchange services such as WellWallet and Kyrrex, converted part to Monero through Wagyu and bridged across several blockchains. He has indicated that the $133 million covers only what is visible on-chain and that losses through over-the-counter trades are not counted, Raymond reports.

How the attackers were able to issue the transfers is not known. One of Raymond’s sources suspects an inside human failure, such as a variant of CEO fraud, rather than a breach of the bank's payment systems.

Not North Korea

ZachXBT wrote that he has "a high degree of confidence" the thief is not North Korea's Lazarus Group, citing several laundering indicators. That is his own assessment: no government agency or the bank has said who is behind the theft. That sets it apart from the Binance theft the FBI attributed to North Korea a few days earlier.

According to Raymond’s sources, the bank realised late that it was the victim, and without its confirmation exchanges and stablecoin issuers could not freeze the funds in time. ZachXBT told BFM that the bank was slow to alert the authorities, and Raymond reports his estimate that more than $30 million could have been frozen if the theft had been reported quickly.