France's Crédit Mutuel Arkéa Breached via Service Provider Platform; Attackers Execute Fraudulent Transfers Using Bank's Own Accounts

What Happened

Crédit Mutuel Arkéa issued a press release on November 4 announcing that it had suffered an attack resulting in fraudulent transactions; upon detecting the attack, the group notified competent and supervisory authorities and decided to temporarily suspend certain transactions as a precautionary measure ^[1].

In a subsequent FAQ page, the bank stated that the attackers did not enter through its subsidiary Fortuneo, but rather reached Crédit Mutuel Arkéa directly via a service provider's platform; the bank ruled out internal human error, describing the incident as a sophisticated external attack that is now under control ^[2].

According to BleepingComputer, the attackers used the bank's own accounts—rather than customer accounts—to initiate transfers to other financial institutions and convert the funds into cryptocurrency; the incident was first flagged on November 2 by blockchain investigator ZachXBT ^[3]. iThome similarly reported that attackers gained access through an external service provider's platform and used the bank's proprietary accounts to conduct unauthorized transfers ^[4].

Scope of Impact

The bank stated that the incident had no impact on customer assets and only caused delays in executing certain transfers, adding that while the financial amount involved is still being assessed, it does not affect the group's financial soundness ^[1].

Regarding circulating claims that €118 million ($133 million) was stolen, the bank declined to confirm the exact figure and only confirmed the order of magnitude; some funds have already been frozen, and further recovery actions are underway ^[2]. The estimated amount originated from ZachXBT, who stated that the funds were withdrawn in USDC and USDT stablecoins .