WORLDTECHCrédit Mutuel Arkéa Says Hackers Used a Supplier to Move Up to $133 Million
French cooperative bank Crédit Mutuel Arkéa says attackers went through a third-party provider and used its own account to send fraudulent transactions of up to $133 million, forcing it to suspend certain systems. The bank says customer assets were not touched.
How the intruders reached the bank's account
Crédit Mutuel Arkéa, a major French cooperative banking and insurance group based in Brest, Brittany, says the intruders never needed to target customer accounts. A service provider gave them a way in, and from there they routed transactions to other banking organisations through the bank's own account.
The bank has since switched off certain systems. Its statement of November 4 calls the incident contained, confirms that customer assets remained intact and notes that some transfers were held back.
Reported sums differ between sources
The bank cites up to $133 million. A report quoted on Thursday puts the loss lower, at around €100 million ($112.61 million), calls it a rare success for cybercriminals against a mainstream lender and says the institution is working to recover the money.
Blockchain researcher ZachXBT, who flagged a large unauthorized withdrawal from several centralized exchange accounts a day before the bank's disclosure, estimates the possible theft at up to 118 million euros ($133 million). He describes the funds leaving as the USDC and USDT stablecoins, which were swapped for ETH, moved through instant exchanges, converted into XMR and bridged across several chains.
Investigation and attribution remain open
The Paris prosecutor's cybercrime unit opened an investigation after a complaint from Crédit Mutuel Arkéa, and France's cybercrime police are leading the probe. The attacker has not been identified.
ZachXBT considers it highly unlikely that the Lazarus Group is responsible, judging by money-laundering patterns. According to BleepingComputer, the researcher argued that the lack of public disclosure let attackers launder $30 million by November 3, which could have prevented EU authorities from freezing the funds.
Customers warned about phishing
Alongside the investigation, the bank has warned customers that the risk of phishing attempts has increased.
Open questions
- How much of the sum can the bank recover?
- Which service provider was exploited, and how did the attackers gain access to it?
- Who is behind the attack, if the Lazarus Group is unlikely as the researcher suggests?