French bank Credit Mutuel Arkea confirmed a cyberattack that let hackers make fraudulent transfers from its own account. On-chain investigator ZachXBT puts the losses above $133 million, a figure the bank has not confirmed.
Credit Mutuel Arkea said Wednesday that a cyberattack allowed hackers to carry out fraudulent transfers from the bank's own account. The Brittany-based lender said the incident was under control, operations were resuming and customer assets were not affected. It suspended some transactions as a precaution.
The bank said the attackers went through the platform of one of its service providers and reached the bank directly. They used its account to send transactions to other banks, which then potentially allowed them to convert the money into cryptocurrency through specialized platforms, the bank said.
The bank will not confirm the figure
Credit Mutuel Arkea does not confirm that 118 million euros, or $133 million, was stolen. It said it can only validate the order of magnitude. Part of the funds has been frozen, and other steps are underway to recover the rest.
AFP reported that the bank put the attack at about 100 million euros in a provisional estimate. According to a bank spokesperson speaking to Reuters, "It is still too early to give a final figure."
The bank denied French press reports that the attackers got in through Fortuneo, its online banking arm. It described the incident as a sophisticated attack from the outside, not the result of human error.
What ZachXBT reported
ZachXBT first flagged the incident on Monday without naming the victim. He wrote on Telegram that an EU entity was suspected of losing more than $106 million from multiple centralized exchange accounts on Nov. 1, with the funds withdrawn as USDC and USDT. He said the funds were then swapped for ether and moved across several chains.
In an update, he found another $27 million or more in exchange withdrawals, bringing the total to more than $133 million. A later post named Credit Mutuel Arkea as the alleged victim.
The bank has not confirmed his figure or his timeline. It has also not said when the attack began, who was behind it or whether any data was taken. It is working with judicial and police authorities, and it warned customers that phishing attempts are possible.
The hack comes less than a week after the record $6.34 billion Binance hack. ZachXBT said in his first post that he was highly confident this incident was not the work of North Korea's Lazarus Group.
Source: Bitcoin Magazine
Trading involves risk.
Risk Disclaimer
