$133M Attack on French Bank Through Service Provider

Crédit Mutuel Arkéa, a French cooperative bank with 5.8 million members, suffered an attack resulting in fraudulent transactions totaling up to $133 million. The attacker accessed the network through a service provider’s platform and used the bank’s own account to initiate transfers to other banking institutions. The bank suspended certain systems, confirmed that customer assets remained unaffected, and noted that the incident delayed execution of certain transactions.

The breach surfaced on November 2 when blockchain fraud investigator ZachXBT detected unauthorized withdrawals from multiple centralized exchange accounts worth approximately 118 million euros in USDC and USDT stablecoins. Due to delayed public disclosure, approximately $30 million was laundered by November 3 before the bank disclosed the incident on November 4. Some funds were blocked.

The bank ruled out human error and characterized the attack as sophisticated. It is collaborating with judicial authorities and police to determine the attack’s origin and methods. Although not confirming the exact amount, the organization acknowledged the funds involved were significant. The bank warned of increased phishing risk and urged customers to remain vigilant against unsolicited communications, avoiding sharing sensitive details over phone or email. Suspicious messages should be verified by calling a bank adviser directly.