Hackers Steal €100 Million From French Bank Crédit Mutuel Arkéa and Race It Into Crypto

Hackers have taken around €100 million from a French bank and turned it into cryptocurrency, and the first public warning came from an online investigator, not the bank.

Crédit Mutuel Arkéa, a regional banking group based in Brittany, confirmed the cyberattack on Wednesday 4 November, calling it a "sophisticated attack coming from the outside". AFP puts the fraudulent transactions at around €100 million ($112 million).

Other reports go higher. The newspaper Le Télégramme and blockchain investigator ZachXBT put the loss at about €118 million ($133 million). The bank would not confirm that number. "We do not confirm this information and can only validate the order of magnitude," it said.

How the money left

Arkéa says the attackers used a third-party service provider's platform to reach an account belonging to the bank itself. From there they sent transfers to other banks, and the money was then converted into crypto on specialised platforms.

The bank has not named the provider or the institutions involved, and it has not explained how the attackers got in. It says human error was not the cause.

Early reports pointed at Fortuneo, Arkéa's online bank, which has more than a million customers. The bank says the attackers did not get in through Fortuneo.

A source quoted by the French tech site Presse-Citron said this was ordinary money taken out and then changed into crypto, not crypto stolen from the bank, and that it relied on accounts opened by fraudsters under false identities.

The trail

ZachXBT raised the alarm first. On Monday he reported that an unnamed European institution may have lost more than $106 million on 1 November, withdrawn as the stablecoins USDC and USDT. On Tuesday he named Arkéa, added another $27 million and published four Ethereum addresses. The bank confirmed the attack the next day.

According to his tracing, the stablecoins were swapped for ether, moved through instant-exchange services and partly converted into Monero, a privacy coin that is much harder to follow.

ZachXBT also alleges that delays in alerting the authorities let the hackers launder more than $30 million that could otherwise have been frozen. Arkéa says it told the relevant authorities immediately after discovering the attack.

The bank says part of the money has been blocked, but it has not said how much.

Who did it?

Nobody knows yet. The Paris public prosecutor's office has opened an investigation into an "attack on an automated data processing system by an organized group", according to AFP.

ZachXBT says with "high confidence" that North Korea's Lazarus Group is not behind it. The theft comes a week after the record $6.3 billion hack of Binance, which investigators tied to North Korea. Nothing reported so far links the two.

What it means for customers

Arkéa serves more than 5.8 million members and customers, and says the attack has no financial impact on them.

• Your money: the bank says the funds came from its own account and clients suffered no losses.
• Transfers: some were delayed or suspended as a precaution. Almost all operations had resumed by Wednesday morning, the bank says.
• Scams: Arkéa is warning customers about phishing. Never give out passwords, card numbers or SMS codes, even if a message appears to come from the bank.

For the bank, the sum is painful but not fatal. Arkéa holds €211.5 billion in total assets and says the amount, still being evaluated, does not threaten "the financial health and solidity of the group". It made €230 million in net profit in the first half of the year, so a €100 million loss would equal more than 40% of that.

What to watch

• The final size of the loss, which the bank is still evaluating.
• Whether Arkéa names the third-party provider, and whether other banks use the same platform.
• How much of the money can be recovered before it disappears into Monero.
• Whether French prosecutors identify the organised group behind the attack.

Figures are early estimates and may change. Photos: Crédit Mutuel Arkéa headquarters in Le Relecq-Kerhuon by FJaffres / Wikimedia Commons (CC BY-SA 4.0); Crédit Mutuel de Bretagne branch by Cremeto / Wikimedia Commons (CC BY-SA 4.0). Video: TF1 INFO. Reporting draws on AFP, Anadolu Agency, crypto.news, Presse-Citron and CryptoTicker.