Crédit Mutuel Arkéa, the Brest-based French cooperative bank with more than 5.8 million members and roughly 211.5 billion euros in assets, disclosed on Nov. 4 that attackers had pushed fraudulent transactions through its systems. Blockchain investigator ZachXBT put the total at up to 118 million euros, roughly $133 million, most of it moved out as dollar-pegged stablecoins.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The bank has not confirmed that number. It says only that it can validate the order of magnitude, that customer balances were untouched and that the sums involved do not threaten its financial strength. The way in, according to the bank, was a platform run by an outside service provider. Arkéa has said the episode had no impact on its assets and amounted to a delay in certain transfers, a framing that sits uneasily beside an investigator’s claim of a nine-figure outflow in stablecoins.
The service provider platform that opened the door
According to BleepingComputer’s report, Arkéa told reporters the intruder reached its network directly through a service provider’s platform, and the bank ruled out human error while calling the operation a sophisticated attack. The provider has not been named, and the bank said its Fortuneo online-banking subsidiary was not involved. The attacker then used Arkéa’s own account, not accounts belonging to customers, to transact with other banks and convert the proceeds into cryptocurrency.
The bank’s own communiqué dated Nov. 4 is far thinner. It says the group detected an attack that allowed fraudulent transactions, alerted its regulators and supervisors, and temporarily suspended certain transactions as a precaution so no further fraudulent transfers could go out. It does not describe the method, name the affected systems or give an amount, which it says is still being assessed. Operations, it adds, are being restored gradually after verification and reinforced security measures.
A related business line deserves a mention without overreach. Brussels Signal notes that a group subsidiary, Arkéa Banking Services, supplies white-label custody, payment rails and a euro payments gateway to neobanks and fintech firms. The report does not say that unit was the entry point, and nothing from the bank connects the two. The distinction matters because a vendor serving many financial clients would turn a single compromise into a sector-wide question, whereas an isolated internal platform would not.
ZachXBT’s estimate and where the money went
ZachXBT, an on-chain investigator who has assisted law enforcement, flagged a large unauthorized withdrawal from several centralized exchange accounts on Nov. 2, a day after it began. His first tally, posted on his public Telegram investigations channel, was above $106 million. By Nov. 4 he had raised it to $133 million, and he cautioned that over-the-counter trades could push the total higher still. The bank has not published a figure of its own.
The funds left as USDC and USDT, two of the largest dollar stablecoins. The Block’s account adds that the attacker swapped USDC for ether, ran assets through instant-exchange services, converted part of the haul into the privacy coin monero and bridged value across several blockchains. ZachXBT said he had a high degree of confidence that the attacker was not tied to North Korea’s Lazarus Group, the state-linked crew behind many large crypto thefts.
Laundering moved quickly. About $30 million had already been cleaned by Nov. 3, according to ZachXBT, who argued that slow alerts to regulators and exchange compliance teams gave the attacker time that law enforcement could otherwise have used to freeze funds.
French outlet IT-Connect, citing estimates from ZachXBT and the analytics firm Bitquery, tallied about $62.98 million of stablecoins swapped for 27,553 ether in one stretch and a $1.14 million Tether freeze. Those are third-party figures, and the bank has confirmed none of them. Blockchain tracing of this kind is public and checkable, though, which is why analysts treat the order of magnitude as credible even while the exact total stays open and the bank declines to put its own number on it.
What Arkéa tells customers to expect
Arkéa says the incident is closed and under control. The one consequence it acknowledges for customers is a delay in some transfers, and it states that their interests are fully protected. It also warned of phishing in the wake of the attack: members should never share a login, password, card number or SMS validation code, and should check any doubtful message by contacting their adviser directly rather than replying. Arkéa serves more than 5.8 million members and customers across its brands, so even a modest rate of successful scams would reach a large number of households, which is why the warning arrived in the very first statement.
Kraken and Crypto.com restricted accounts or blocked funds tied to the incident, Brussels Signal reports, and both said their own systems were not compromised. French cyber police and digital forensics specialists are investigating, and the Banque de France declined to comment to AFP. The bank says it is working with judicial authorities and police to establish where the attack came from and how it was carried out.
The open questions are concrete ones: the name of the service provider, the true size of the loss once it is fully assessed, and how much of the roughly $30 million laundered by Nov. 3 can still be recovered. Arkéa has promised further updates as its investigation produces them, and ZachXBT has said the figures could still rise. Until the bank publishes its own accounting, the $133 million stays an estimate resting on public blockchain records rather than an audited loss.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
