Crédit Mutuel Arkéa hit by roughly $133 million fraudulent transfers
Original title: $133 million stolen from French bank via exploited service provider
The bank confirms only the scale; ZachXBT tracked stablecoins moved toward ether and Monero, and a Fortuneo entry is disputed.
Attackers used Crédit Mutuel Arkéa’s own account to wire money that investigator ZachXBT linked to about $133 million leaving centralized exchanges as USDC and USDT. The French cooperative, with €211.5 billion in assets and more than 5.8 million customers, said on November 4 that an unnamed service provider’s platform was used, not customer accounts. It denied a Fortuneo entry point and human error, said the attack is contained, and reported that some funds were blocked. Customer assets were not affected, though some transfers were delayed, and the bank warned of follow-on phishing.
Unconfirmed: The exact loss, any Fortuneo role and the attacker’s identity are unconfirmed; ZachXBT’s exclusion of Lazarus is his assessment.
- ZachXBT flagged over $106 million on November 1, then another $27 million on November 3.
- He said funds were swapped toward ether and partly converted to Monero.
- Arkéa would not confirm €118 million and said it can only validate the order of magnitude.
- Journalist Grégory Raymond linked transfers to Fortuneo; the bank rejects that claim.
Impact: About $133 million sent out through the bank’s own account.
- 1.Do not share login IDs, passwords, card numbers or SMS codes; confirm suspicious messages with the bank.
- Victims
- Crédit Mutuel Arkéa
- Organizations
- Fortuneo
- Countries
- France
From the original article
3 min read at helpnetsecurity.com
Attackers siphoned an estimated $133 million from Crédit Mutuel Arkéa by using the bank’s own account to wire money to other banks, from where it was possibly converted into cryptocurrency. The French cooperative banking group, which has €211. 5 billion in total assets and more than 5.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.