French cooperative bank Crédit Mutuel Arkéa was hit by a sophisticated cyberattack that enabled unauthorized transactions potentially worth up to €118 million ($133 million). The attackers used the bank’s own accounts to transfer funds through other financial institutions and convert them into cryptocurrency, prompting Arkéa to shut down some systems. The bank said customer assets were not affected, although certain transactions were delayed.
Crédit Mutuel Arkéa is a major French banking group with more than 5.8 million members and €211.5 billion in assets.
Attack enabled large cryptocurrency withdrawals
Details of the incident emerged on November 2 from blockchain fraud investigator ZachXBT, who warned that large unauthorized withdrawals had occurred from multiple centralized cryptocurrency exchange accounts the previous day.
Investigators said the attackers had stolen up to €118 million ($133 million), withdrawing the money as the USDC and USDT stablecoins, according to a report shared by ZachXBT.
ZachXBT did not initially identify the affected organization. The investigator said the delay in disclosure allowed the attackers to launder $30 million before European Union law enforcement could freeze the funds by November 3.
Source: ZachXBT
Bank says customer assets were not affected
Crédit Mutuel Arkéa announced the attack on November 4, saying the incident was “currently closed and under control” and that its operations were gradually returning to normal.
“Crédit Mutuel Arkéa would like to reassure all its customers across its federations and subsidiaries that this incident does not affect their assets, but merely delays the execution of certain remittance transactions,” the bank said in a statement. The quotation is machine-translated.
The bank warned customers about an increased risk of phishing linked to the incident. It advised them to be cautious with unsolicited messages and not to share sensitive information by telephone or email.
Customers should verify suspicious communications by contacting their bank adviser directly using a trusted telephone number.
Attack entered through service provider platform
On a separate FAQ page, Crédit Mutuel Arkéa explained that the attackers accessed its network through a service provider’s platform. The bank said Fortuneo was not affected.
The attackers then used Arkéa’s accounts, rather than customer accounts, to conduct transactions with other banking organizations and convert the funds into cryptocurrency.
Arkéa did not confirm ZachXBT’s estimate of the stolen amount. However, it acknowledged that the sum was large and said some funds had been blocked.
“Do we confirm that 118 million euros ($133 million) was stolen? We have not confirmed this information and can only confirm an order of magnitude,” the bank said.
The bank ruled out human error on its part and described the incident as a “sophisticated attack.” It is working with law enforcement and police to determine the precise cause and method of the intrusion.
BleepingComputer contacted Crédit Mutuel Arkéa for additional information about the attack and the investigation’s status but had not received a response at the time of publication.
Source: www.bleepingcomputer.com