In this article4 sections
Crédit Mutuel Arkéa confirmed on Wednesday that a cyberattack allowed hackers to make fraudulent transfers from the bank’s own account, an incident that on-chain investigator ZachXBT has valued at more than $133 million and that the lender has declined to confirm, according to Bitcoin Magazine.
The Brittany-based bank said the incident was under control, that operations were resuming and that customer assets were untouched. It suspended some transactions as a precaution. In its statement, the bank said the episode had no impact on customer assets and had caused only a delay in executing certain transfers.
Also readBitget CEO Says Exchange Can Absorb $350M Hack Loss
Key facts
- The bank said attackers entered through the platform of one of its service providers and used the bank’s own account to send transactions to other banks, which it said could have allowed conversion into cryptocurrency through specialized platforms.
- Asked about 118 million euros, or $133 million, the bank said it does not confirm the figure and can only validate the order of magnitude. AFP reported a provisional estimate of about 100 million euros, and Reuters reported the bank saying its losses were lower than $133 million.
- ZachXBT first flagged an unnamed EU entity on Monday after more than $106 million was withdrawn from multiple centralized exchange accounts on Nov. 1 as USDC and USDT, then added another $27 million or more in withdrawals.
- Bitcoin Magazine reported that ZachXBT named Crédit Mutuel Arkéa as the alleged victim and said the attack took place over multiple days.
- Crédit Mutuel Arkéa has 5.8 million clients and 211.5 billion euros, or about $238 billion, in assets, and reported net profit of 230 million euros in the first half, per Reuters and AFP figures cited by Bitcoin Magazine.
Two accounts of the same loss
The bank denied French press reports that the intrusion came through Fortuneo, its online banking arm, and described the event as a sophisticated external attack rather than the result of human error. It said it had not determined when the attack began, who was behind it or whether any data was taken, and that it is working with judicial and police authorities while having notified its supervisors.
CoinCentral reported that Kraken and Crypto.com said they restricted accounts or blocked funds tied to the suspected theft, and that both said their own platforms remained secure. CoinCentral also reported that blockchain analytics firm Bitquery traced withdrawals from accounts at Kraken, Crypto.com and OKX and found about $63 million in stablecoins converted into Ether within four hours. Those details did not appear in Bitcoin Magazine’s account.
Also readLopp: AI Bug Finding Pushes Bitcoin Core Security Shift
The two outlets also split on the bank’s size. CoinCentral reported ZachXBT describing it as a cooperative lender with about $235 billion in assets and more than 5.6 million customers, while other reports put assets at 211.5 billion euros, roughly $237 billion, and Bitcoin Magazine cited 5.8 million clients. CoinCentral reported the naming came on the evening of Nov. 3, while Bitcoin Magazine reported ZachXBT named the bank in a later post; both place his first warning in the preceding days.
Why it matters
A confirmed theft routed through a bank’s own account, rather than a customer’s, shifts attention to the third-party platforms lenders rely on and to how quickly stolen stablecoins can be swapped and bridged. The incident landed less than a week after the record $6.34 billion Binance hack, which blockchain analysis firms have linked to North Korea, and Brazil’s Mercado Bitcoin also froze deposits and withdrawals this week after a security incident. ZachXBT said he was highly confident this attack was not the work of Lazarus Group, and he criticized the institution for allegedly allowing more than $30 million to be laundered.
What to watch
The bank has said it is still too early to give a final figure and that part of the funds has been frozen while other recovery steps continue. A confirmed loss total, or the judicial inquiry’s findings on the attack’s origin, would settle the gap between the bank’s provisional estimates and ZachXBT’s figure.
This article reports on an ongoing investigation and is not financial advice; cryptocurrency markets are volatile and uncertain.
Sources: Bitcoin Magazine, CoinCentral
