Crédit Mutuel Arkéa: its own money, not customers’, left through a supplier’s platform

01What the bank has said, and what it has not

Its first statement, at 13:00 Paris time on 4 November, reported “an attack that enabled fraudulent operations to be carried out”. The group informed its supervisors, suspended some transactions as a precaution and was resuming operations through the morning; customers’ holdings were not affected, and some transfers were only delayed. The amounts were “still being assessed” and do not threaten the group’s solidity.¹ The follow-up added the detail: the bank’s own account was used; no “entry” was made through its online bank Fortuneo, as some press had written; it was not human error at Arkéa but “a sophisticated attack from outside, now contained”; and “part of the funds concerned could be blocked, and other actions are under way to recover them”.²

It has not named the provider, said what its platform does, given a date for the transfers or said how much was blocked. It is working with the judicial and police authorities on “the origin of the attack and its modus operandi”.²

02From a bank transfer to crypto, as an investigator traced it

The figure traces to ZachXBT, an independent investigator who follows stolen funds on public blockchains. On 2 November he reported that an unnamed “EU entity” was suspected of losing more than US$106m from “multiple centralized exchange accounts” on 1 November, withdrawn as the stablecoins USDC and USDT. In the 24 hours before his post, he wrote, the funds were swapped for ether, sent to instant-exchange services, converted to Monero and bridged across blockchains.³ On 4 November he raised the total to more than US$133m, some of it withdrawn after his first post, said the attack ran “for multiple days”, and named the institution as “allegedly” Crédit Mutuel Arkéa.⁴

Read together, the two accounts describe the path: money leaves the bank’s own account by ordinary transfer, lands at other institutions, funds exchange accounts and comes out as stablecoins. The link between ZachXBT’s wallets and Arkéa is his, and the bank has confirmed only the order of magnitude.

The stages matter for what can be clawed back. Stablecoins have issuers that can freeze them, as Tether and Circle did after Binance’s theft; ether has no issuer, and Monero is built to hide where funds go. ZachXBT’s 1 November date was a Sunday and All Saints’ Day, a public holiday in France.⁵ Arkéa has not said when the transfers left its account.

In India, CERT-In said on 4 November that attackers calling NBFCs’ own payment APIs time their transfers for weekends and holidays.⁶ To watch: the final amount, the provider’s name and how much the freeze recovers.