Crédit Mutuel Arkéa Says Attackers Drained Its Own Account and May Have Cashed Out in Crypto

Crédit Mutuel Arkéa, the French banking group that onchain investigator ZachXBT named as the victim of a suspected nine-figure theft, confirmed on Nov. 4 that it was hit by an attack that let fraudulent operations go through. In a second statement the same day, the bank said the attackers may have turned the money into crypto.

According to that follow-up, which Arkéa published in French as answers to press questions, the attackers used the bank’s own account, not customer accounts, to send transactions to other banks. Those transactions then potentially allowed them to convert the funds into crypto through specialized platforms, Arkéa said. Its first statement, issued at 1 p.m. local time, did not mention crypto.

Asked whether €118 million ($133 million) had been taken, Arkéa said in the Q&A statement that it does not confirm those figures and can only validate the order of magnitude. Part of the funds has been blocked and further steps to recover them are underway, the bank said, adding that it is too early to give a final amount and that the sums at stake do not threaten its financial health.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

Arkéa’s statements are the bank’s first public account of the attack. They match ZachXBT’s account on the victim and on a possible move into crypto, but they describe a different route. ZachXBT said the money was drained from exchange accounts he tied to the bank, while Arkéa said the attackers sent transfers from its own account through other banks, which only potentially allowed them to convert the funds into crypto. The bank has not put its own number on the loss, so the $133 million figure remains an outside estimate whose scale, but not exact size, Arkéa accepts.

Arkéa rejected press reports that the attackers came in through Fortuneo, the group’s online bank. Instead, it said, they went through a platform run by one of its service providers and reached the bank directly. Arkéa called it a sophisticated attack from outside, said it was not caused by human error at the bank, and said its teams are working with judicial and police authorities to determine where the attack came from and how it was carried out.

Customer assets were not affected, Arkéa said, though some transfers were executed late after it suspended certain transactions as a precaution. Almost all operations resumed during the morning, it said. The bank also warned customers of possible phishing attempts and said it had informed its supervisory authorities once the attack was detected.

ZachXBT began posting about the theft on Nov. 2, when he flagged $106 million in USDC and USDT withdrawn the day before from exchange accounts belonging to an unnamed EU entity. On Nov. 3, he traced another $27 million and put the total at $133 million, alleging the loss was being kept quiet and that the silence let the attacker launder more than $30 million. Late on Nov. 3 U.S. time, he identified the victim as Crédit Mutuel Arkéa, Unchained reported.

Related Listen: Is THORChain a Money Laundering Service? A Chinese Crime Boss Says Yes

The post Crédit Mutuel Arkéa Says Attackers Drained Its Own Account and May Have Cashed Out in Crypto appeared first on Unchained.