Crédit Mutuel Arkéa confirms attack enabled fraudulent transactions
French banking group Crédit Mutuel Arkéa says attackers used a service provider’s platform to reach its network and carry out fraudulent transactions. The bank confirmed the incident in a statement on November 4, but said it was too early to establish the total amount involved.
Reports from blockchain investigator ZachXBT had put the apparent losses at $133 million. The investigator first described $106 million in withdrawals from multiple centralized cryptocurrency exchange accounts, then reported a further $27 million the following day. Those figures have not been confirmed by the bank, which says it is still assessing the financial consequences.
Attackers used the bank’s own account
In an incident FAQ, Crédit Mutuel Arkéa said the attackers reached its network through a service provider’s platform. They then used an account belonging to the bank to make transactions to other financial institutions. The bank said those transfers may have enabled the money to be converted into cryptocurrency through specialized platforms.
Crucially, the bank stated that the attackers did not use customer accounts belonging to its federations or subsidiaries. It also said the incident has no financial consequences for customers and that the sums involved are not expected to threaten the group’s financial health or stability. These assurances concern customer funds and the bank’s stability; they do not establish the final value of the fraudulent transactions.
After identifying the attack, the bank said its teams activated security measures to contain the incident and prevent further fraudulent activity. Its investigation and efforts to recover funds were continuing. Crédit Mutuel Arkéa said some of the funds had been frozen, while additional actions were underway.
Blockchain investigator described movement of funds
ZachXBT’s initial account, posted on Telegram on November 2, referred to an unnamed European entity and activity involving multiple centralized exchange accounts. The investigator later said the money was being moved through exchanges and other cryptocurrency services, including conversions and transfers across multiple blockchains. The descriptions are the investigator’s findings, not a complete accounting confirmed by the bank.
ZachXBT also said the incident did not appear to involve North Korea’s Lazarus Group. Crédit Mutuel Arkéa’s public statements cited in the incident FAQ did not attribute the attack to a particular threat actor. The responsible party and the full path into the bank’s network therefore remain unconfirmed in the information disclosed so far.
Third-party access remains a key control point
The bank’s account of the intrusion places a service provider in the route attackers used to reach its network. For financial institutions, the incident underscores the importance of tightly controlling third-party access, limiting the privileges available through external platforms, and monitoring sensitive accounts for unusual transaction activity. These controls can help organizations detect misuse earlier and restrict the potential reach of a compromised connection.
Organizations responding to similar incidents also need to coordinate quickly across security, fraud, payments and third-party risk teams. Where transfers involve other institutions or cryptocurrency platforms, timely communication can support efforts to identify and freeze funds. In this case, the bank said some funds had been frozen, but it did not disclose how much had been recovered or provide a final loss estimate.
Crédit Mutuel Arkéa advised customers to watch for phishing attempts following publicity about the incident. Attackers may exploit public attention around a financial event to send deceptive messages or impersonate a bank. Customers should treat unexpected requests for account credentials or payment details with caution and use established bank channels to verify communications.
