Hackers drain up to €118 million from French bank Crédit Mutuel Arkéa through a service provider

French cooperative bank Crédit Mutuel Arkéa has confirmed a cyberattack in which criminals moved a large sum out of the bank's own accounts and converted it into cryptocurrency. The attackers got in through a service provider rather than attacking the bank head-on.

What happened

Blockchain investigator ZachXBT first flagged the theft on 2 November. He traced large withdrawals that began around 31 October and estimated the haul at up to €118 million ($133 million), cashed out as the stablecoins USDC and USDT. By 3 November, he said, about $30 million had already been laundered before European police could freeze it.

Arkéa disclosed the incident on 4 November and called it "closed and under control". It would not confirm the exact figure, saying only that it could "validate the order of magnitude". Some of the funds were blocked.

How the attackers got in

The bank says the intruders reached its network directly through a service provider's platform. The provider has not been named; the bank has ruled out its online subsidiary Fortuneo. Arkéa also ruled out human error and described a "sophisticated attack".

Once inside, the attackers used the bank's own account to send money to other banks and turn it into crypto. Arkéa says customer money was not affected; some customer transfers were delayed while systems were suspended.

Why it matters

This is a supply-chain attack aimed at the money itself. Banks spend heavily on protecting their own perimeter, but every provider with a connection into payment systems is another door. Here, the door led straight to the bank's treasury.

It also shows how fast stolen funds now move. Stablecoins let attackers launder tens of millions within days, faster than freezing orders can catch up.

What to do

If you run security for a financial or payments firm:

• List every third party with network or API access to payment systems, and check what each one can actually do.
• Put hard limits and out-of-band approval on large or unusual outgoing transfers, even from internal accounts.
• Alert on new transfer destinations and on crypto on-ramp counterparties.

If you are an Arkéa or Crédit Mutuel customer:

• Expect phishing that uses this news. Ignore unsolicited calls, texts and emails about your account.
• Never share codes or passwords by phone or email. Call your adviser on a number you already know if something looks off.

The investigation, led by French judicial authorities and police, is ongoing.

Original reporting: BleepingComputer