Crédit Mutuel Arkéa Says Cyberattack Led to €100 Million Theft
Summary
Crédit Mutuel Arkéa says attackers used a service provider’s platform to steal €100 million through transfers. The bank says the attack is contained and customer assets are safe; the culprit has not been identified.
Key points
- Crédit Mutuel Arkéa confirmed the cyberattack and later stated that the reported theft totaled €100 million; it is trying to recover the funds.
- The bank says attackers used a service provider’s platform to reach it and used its own account to make transfers to other financial institutions.
- The bank said the attack was contained, customer assets were not threatened, and precautionary measures delayed some transfers.
- ZachXBT reported that an illicit actor was swapping USDC for ether and laundering funds across multiple chains; Kraken restricted accounts that appeared linked to the crime.
- The culprit has not been firmly identified. ZachXBT expressed high confidence the attacker was not Lazarus Group, citing multiple laundering indicators.
Article Details
- Victim Organization
- Crédit Mutuel Arkéa
- Incident Type
- Supply chain cyberattack resulting in the theft of funds through transactions to other banking institutions.
- Affected Data Size
- The bank reported that 100 million euros (approximately $112 million) was stolen. ZachXBT initially estimated $133 million or more; the bank disputed that figure.
- Operational Impact
- The bank said the attack was contained and caused delays in the execution of certain transfer transactions. It said there was no threat to customer assets or its financial stability.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed