TheBlock
Crédit Mutuel Arkéa confirmed that a cyberattack enabled fraudulent transfers from one of its accounts, with the funds converted into crypto. Onchain investigator ZachXBT estimated losses at more than $133 million, but the bank has not confirmed a final amount and said some stolen funds had been blocked.
The bank said the incident was contained and client assets were unaffected. It reported delays in the execution of certain transfers and said its teams activated security measures to stop further fraudulent movements. Crédit Mutuel Arkéa said the amounts involved do not threaten its financial strength.
Why it matters
The suspected scale puts a spotlight on the risks banks face when attackers move stolen funds through crypto services and across chains. ZachXBT said the activity unfolded over several days and that the loss estimate could rise, including if additional over-the-counter transactions were involved.
He described a laundering route that included swapping USDC for ETH, using instant exchanges WellWallet and Kyrrex, converting funds into XMR through Wagyu, and bridging assets across multiple chains. ZachXBT said he had a high degree of confidence the attacker was not linked to North Korea's Lazarus Group.
Market impact
The incident did not affect customer assets, according to the bank, and the bank said it was contained. The amount remains uncertain: Crédit Mutuel Arkéa acknowledged the broad order of magnitude but has not published a final loss figure.
The bank has more than 12,000 employees and 5.8 million members and customers. Its reported total assets are €211.5 billion ($238.1 billion), figures that provide context for its statement that the incident does not undermine its financial strength.
Frequently asked questions
-
Did the Crédit Mutuel Arkéa attack affect customer assets?
The bank said customer assets were unaffected. It reported delays in the execution of certain transfers.
-
How much was allegedly stolen from Crédit Mutuel Arkéa?
ZachXBT estimated losses at more than $133 million. The bank has not confirmed a final amount, though it acknowledged the broad order of magnitude.
-
How were the stolen funds moved through crypto?
ZachXBT described swaps from USDC to ETH, transfers through WellWallet and Kyrrex, conversion into XMR through Wagyu, and bridging across multiple chains.
-
Was the attack linked to North Korea's Lazarus Group?
ZachXBT said he had a high degree of confidence that the attacker was not associated with Lazarus Group.
-
What did Crédit Mutuel Arkéa say about its financial position?
The bank said the amounts involved would not undermine its financial strength. It reported total assets of €211.5 billion ($238.1 billion).
WuBlockchain
CryptoSlate
Altcoin Daily
Lookonchain