Crédit Mutuel Arkéa says attack via provider moved about $133 million

Crédit Mutuel Arkéa says a contained attack through a service provider moved roughly $133 million; exact loss and crypto conversion remain disputed.

Crédit Mutuel Arkéa says attackers reached one of its own accounts through an unnamed service provider’s platform and initiated fraudulent transfers to other institutions. The bank says the incident is contained, operations are returning after temporary restrictions, customer assets were not affected, and some transfers were delayed. Investigators, including ZachXBT, have tied the activity to about $133 million leaving exchanges as USDC and USDT and moving toward ether and Monero. The bank says it can confirm only the order of magnitude: it would not confirm €118 million, while DataBreaches.net reports the bank put the loss near €100 million and said the stolen funds were not cryptocurrency, though they could have been converted later. Some funds were blocked, recovery continues, and French authorities are investigating. The bank rejected a reported Fortuneo entry point and human error, and warned of follow-on phishing.