French banking group Crédit Mutuel Arkéa is investigating a cyberattack that allegedly enabled fraudulent transfers valued in the range of €118 million, or about $133 million. The bank said the incident involved access obtained through a third-party service provider and led to temporary disruption of some transfer processing systems.
Arkèa stated that customer accounts and assets were not affected. According to the bank, the intruder used an account belonging to the organization itself to initiate transactions involving other financial institutions, rather than accessing individual customer accounts.
The incident became public after blockchain investigator ZachXBT reported unusual withdrawals from accounts at multiple centralized cryptocurrency exchanges. The researcher said funds may have been converted into the USDC and USDT stablecoins, and warned that delayed disclosure could have given the attackers time to move or launder part of the proceeds.
In its public statements, Arkéa did not confirm the reported total, but said the figure was of the correct general scale. The bank added that some of the funds had been blocked.
Third-party platform cited
In a customer FAQ, Arkéa said the attacker reached its environment through a service provider's platform. It said the provider was not Fortuneo, the online bank owned by the group. The organization characterized the event as a sophisticated attack and said it had found no evidence that employee error caused the compromise.
Arkèa, which serves millions of members and manages more than €211 billion in assets, said the incident had been contained and that normal operations were progressively resuming. Some customers experienced delays in the execution of transfers while the bank responded to the event.
Investigation and customer guidance
The bank said it is working with law enforcement and judicial authorities to determine how the intrusion occurred and identify those responsible. The full technical details of the compromise, including the identity of the affected provider and the method used to access the platform, have not been publicly disclosed.
Arkèa also warned customers to expect possible phishing attempts following the incident. It advised customers not to share sensitive information through unsolicited calls or emails and to verify suspicious communications directly with their usual bank contact.