Crédit Mutuel Arkéa said attackers used a service provider’s platform to reach the French bank and send fraudulent transfers from its own account, while customer assets remained unaffected.
The transfers went to other banks, Arkéa said. The payments may have been routed through specialist platforms to convert funds into cryptocurrency, but the bank has not confirmed that any conversion took place.
Arkéa temporarily halted some transactions after detecting the incident and notified authorities and supervisors. Almost all operations resumed on Nov. 4 after checks and additional security measures, the bank said. The pause delayed some transfers, though customer assets were not affected.
The bank said it had blocked some funds and was working to recover others. It is cooperating with judicial and law enforcement authorities to establish how the attack began and was carried out. Arkéa has not named the service provider or explained how attackers gained access through its platform. Its follow-up did not give a final account of the financial impact.
Reports put the loss at €118 million ($133 million), but Arkéa said it could confirm only the approximate scale, not that exact amount. Separately, blockchain investigator ZachXBT estimated that more than $133 million was stolen; the bank has not confirmed his estimate. EconoTimes’ earlier report on the attack covered the initial disclosure and ZachXBT’s estimate.
In its initial statement, Arkéa said the loss was still being assessed and would not threaten its financial strength. The cooperative banking and financial services group says it has more than 5.8 million members and customers and €211.5 billion in total assets.
Arkéa said it would provide further information when its review supports an update. The final loss and recovery amounts remain under assessment.
