Crédit Mutuel Arkéa confirms cyberattack after ZachXBT flags $133M in suspected losses

French bank Crédit Mutuel Arkéa has confirmed that a cyberattack enabled fraudulent transfers from its account, which were converted into crypto via specialized platforms.

In a statement released Wednesday, the bank said that client assets were unaffected and the incident has been contained.

"As soon as this attack was identified, our teams immediately activated the necessary security measures to contain the incident and prevent any further fraudulent movements against Crédit Mutuel Arkéa," the bank said. 

"We wish to reassure all of our customers: this incident has had no impact on their assets," the bank added. "It only caused a delay in the execution of certain transfers."

ZachXBT's report

Onchain sleuth ZachXBT, who first publicly flagged the exploit on Nov. 2, estimated the losses at more than $133 million. He noted that the figure could rise, as the attack unfolded over several days and may have involved additional over-the-counter transactions.

While Crédit Mutuel Arkéa did not confirm the exact amount of losses, it validated the order of magnitude. The bank said some of the stolen funds had been blocked.

"While it is therefore still too early to communicate a final amount, we can already state that the amounts involved are in no way of a nature to undermine the financial strength and soundness of Crédit Mutuel Arkéa," the bank said.

ZachXBT previously reported that the attacker had been moving stolen funds through a series of transactions, including swapping USDC for ETH, routing assets through instant exchanges such as WellWallet and Kyrrex, converting funds into XMR via Wagyu, and bridging assets across multiple chains. 

He also said he has a "high degree of confidence" that the attacker was not associated with North Korea's Lazarus Group.

The bank has over 12,000 employees and more than 5.8 million members and customers. Its reported total assets are €211.5 billion ($238.1 billion), according to the statement.