By 
Crédit Mutuel Arkéa, a prominent French banking institution, is grappling with the aftershocks of a cyberattack that has raised serious concerns regarding financial security. Initial reports suggest that the incident may be connected to a staggering cryptocurrency theft that exceeds $133 million. Although Arkéa has publicly acknowledged the attack, it has not yet confirmed specific loss figures, leaving much of the situation shrouded in uncertainty.
In response to the incident, Arkéa has stated that the situation is under control, and operations are gradually getting back to normal. The bank reassured its customers that their assets remain secure. As a precaution, certain financial transactions were temporarily halted to avert further fraudulent activities while the bank’s security teams conduct a comprehensive assessment of their systems and implement additional protective measures. While customers have reported some delays in processing transfers, Arkéa insists that their funds are safe.
The investigation into the cyberattack has revealed troubling findings from blockchain investigator ZachXBT, who initially reported over $106 million in suspicious cryptocurrency withdrawals occurring on November 1. This figure later increased with an additional $27 million drawn, leading to an estimate exceeding $133 million. It is important to note that these numbers are still under investigation and have not been confirmed as losses by the bank itself.
ZachXBT's work highlights the concerning trend of fraudulent transactions making their way through established financial systems, underscoring a growing challenge within the banking sector. Cybersecurity analysts have made connections between Arkéa’s incident and previous attacks on other financial institutions, known as BREEZE COMET, although there is currently no solid evidence linking these separate events directly to each other.
The blockchain investigator’s findings suggest sophisticated tactics were used in the attack, with cryptocurrency being siphoned off from exchange accounts using popular tokens like USDC and USDT. These funds were subsequently crypto-mixed and transformed into Ethereum, before being transferred across multiple blockchains and ultimately exchanged for Monero, a cryptocurrency known for its privacy features. ZachXBT posits that the total drained amount could potentially rise further due to additional over-the-counter trades that are yet to be accounted for.
In Arkéa's official statement, the bank has indicated that it is still in the process of evaluating the full extent of the impact but reassured stakeholders that its financial stability is not at immediate risk. However, significant questions remain about how hackers gained unauthorised access to its systems—particularly regarding the methods used to compromise security and the identity of the perpetrators.
While there has been speculation linking the fraud to Fortuneo, the online banking subsidiary of Arkéa, the details on how the entry point was exploited remain vague. There is insufficient information to determine whether a specific software vulnerability was responsible or if compromised credentials played a part in the breach. As investigations unfold, claims about the attackers' identities should be treated cautiously, distinct from the verified aspects of the incident.
Adding to the unease, Arkéa has also issued warnings about potential phishing scams that may arise in the wake of the attack. Cybercriminals often capitalise on such events, using the chaos to launch deceptive campaigns. Arkéa’s communication emphasises that fraudsters might exploit customer anxieties through counterfeit security messages, increasing the urgency for vigilance among its users.
Cybersecurity analysts have previously documented similar strategies used by scammers, including impersonating banks to coax funds from unsuspecting victims. Arkéa has urged its customers to be particularly cautious during this period and to avoid sharing sensitive information like passwords, bank card details, or codes received via SMS. If any suspicious communication is received, customers are encouraged to reach out to their bank advisers directly.
As the situation continues to develop, Arkéa has reiterated its commitment to assessing the implications of the cyberattack and implementing stronger security measure moving forward. Further updates are expected as the institution works to navigate this fraught landscape and safeguard its operations.
