French banking group Crédit Mutuel Arkéa has confirmed that it was hit by a cyberattack that allowed fraudulent operations, a day after onchain investigator ZachXBT named it as the alleged victim of a crypto theft of more than $133 million.
In a statement shared with Decrypt on Wednesday, the bank said the incident was "closed and now under control," and that operations were resuming gradually after it put stronger security measures in place. It said customers' assets were not affected, and that the attack had only delayed the execution of some transfers.
The bank did not mention crypto or say how much was taken. The amounts affected are still being assessed, but are "in any event not of a nature to call into question the solidity and financial health of the group," it said, according to Decrypt's translation.
Crédit Mutuel Arkéa said it informed the relevant supervisory authorities as soon as it detected the attack, and temporarily suspended some transactions as a precaution to prevent further fraudulent movements. It also warned customers to watch out for phishing attempts following the attack. Decrypt has reached out to Crédit Mutuel Arkéa for further comment, including on whether the losses involved crypto.
ZachXBT's allegations
"Disclosing the EU financial institution exploited for $133M+ is allegedly Credit Mutuel Arkea, a French bank with $235B in assets," ZachXBT wrote on his Telegram channel on Tuesday. "The attack on the bank occurred for multiple days. I suspect the amount stolen is larger when accounting for OTC activity."
ZachXBT first flagged the suspected theft on Monday, saying an unnamed entity in the European Union may have lost more than $106 million from accounts at several crypto exchanges on November 1. The funds were withdrawn as USDC and USDT, he said in his original post, and the attacker then swapped USDC for ETH, moved funds through instant exchanges, converted some into privacy coin Monero and bridged across multiple chains.
In an update on Tuesday, he said he had identified a further $27 million in exchange withdrawals by the attacker, bringing the total to more than $133 million, and that some of those withdrawals took place after his initial disclosure. He also published four Ethereum addresses he said were linked to the theft.
"My working theory is a large financial institution in Western Europe was exploited and it's currently being covered up," ZachXBT wrote at the time, accusing it of not having conducted "proper incident disclosure" and thereby preventing law enforcement from freezing some $30 million in stolen funds.
He did not say how he had identified the bank, or how the attacker gained access to its exchange accounts.
The mutual banking group has been preparing to move into crypto. In May, French financial newspaper L'Agefi reported that it had applied for a license under MiCA, the EU's crypto rulebook, to offer crypto services to its retail customers and to provide them as a white-label service through its Arkéa Banking Services division.
The allegation comes days after the $6.3 billion hack of Binance, the largest crypto theft on record, which the FBI has attributed to North Korean hackers. ZachXBT said the attacker in the suspected EU theft remains unidentified, but that he could say "with a high degree of confidence it is NOT Lazarus Group," the North Korean hacking collective, "based on multiple laundering indicators."
