Crédit Mutuel Arkéa: third-party provider breach led to fraudulent transfers of about €118M (US$133M) laundered via stablecoins

Linha do tempo

1. hackread.com ↗ · pub. 09/11/2026 07:49 · coletado 09/11 08:01

   Crédit Mutuel Arkéa loses about €100M in fraudulent transfers after supplier platform breach

   ler a análise desta fonte ocultar

   Crédit Mutuel Arkéa, a French cooperative banking group, reports that attackers took roughly €100 million after reaching its systems through a third-party service provider's platform. They then sent transfers from the bank's own account to other financial institutions, which may have let them convert the money into cryptocurrency. The bank's 4 November communiqué (cm-arkea.com) says the incident is under control, that customer balances were not affected, and that some transfers were only delayed. Blockchain investigator ZachXBT first flagged the suspicious withdrawals on 2 November, and French media and his analysis put the loss near €118 million ($133 million), a figure the bank does not confirm (hackread.com). French prosecutors have opened an investigation, and the bank has notified the European Central Bank and French banking supervisors (hackread.com). No CVE, patch or vulnerability has been published, and the provider and the access method remain undisclosed.

   Technical Details

   • The attackers entered through a platform run by an unnamed service provider. The bank describes an external attack and rejects human error on its side, but gives no technical detail about which control failed (hackread.com).
   • Fraudulent transfers were made from an account owned by the bank, not from customer balances. The bank rejects reports that its online subsidiary Fortuneo was the entry point and says customer accounts of its networks and subsidiaries were not used (hackread.com).
   • As a containment step, the group temporarily suspended some transactions. Most operations resumed on 4 November after checks and extra security measures (hackread.com).
   • No complete transaction trail has been published, so the crypto off-ramp and final destinations are unverified (hackread.com).

   Remediation

   • Customers should be wary of phishing that uses news of the attack. They must not share banking credentials, card details or SMS codes, and should verify any suspicious message directly with their adviser (cm-arkea.com).
   • Waseem Ahmed of Secure.com advises treating every supplier that has a path into internal systems as part of the payment chain, with equivalent controls. He recommends testing whether supplier-level access can send a payment to a beneficiary never paid before, and capping outflows across all systems that can move money over several days, with new or unusual payments held for approval (hackread.com).

   Conflicting Reports

   • Loss amount: Reuters, as relayed by the article, puts it at about €100 million, which the article treats as provisional. ZachXBT and French media put it at about €118 million ($133 million). The bank says it cannot confirm either figure and will only validate the order of magnitude (hackread.com). The bank's communiqué says the amounts are still being assessed (cm-arkea.com).
   • Entry point: some reports named Fortuneo. The bank denies this (hackread.com).
   • Provider: the article says the bank's 4 November statement blamed an unnamed service provider. The communiqué text retrieved from cm-arkea.com does not mention a provider, so this detail could not be verified against that document (cm-arkea.com).
2. helpnetsecurity.com ↗ · pub. 09/11/2026 07:03 · coletado 09/11 08:01

   Crédit Mutuel Arkéa loses an estimated $133M in fraudulent transfers via a compromised service provider

   ler a análise desta fonte ocultar

   Crédit Mutuel Arkéa, the French cooperative banking group that owns the online bank Fortuneo, confirmed a cyberattack that let an unknown actor send fraudulent transfers from its own accounts. Blockchain investigator ZachXBT tracked about $133 million in suspected stolen funds leaving centralized exchanges between November 1 and 3, 2026, and the bank declined to confirm that figure, saying it could only "validate the order of magnitude" (helpnetsecurity.com; cybersecuritynews.com). The bank says the attackers did not use customer accounts and reached it directly through the platform of an unnamed service provider, and it describes the intrusion as a sophisticated external attack that has since been contained (helpnetsecurity.com). Arkéa denies human error and says no entry was made through Fortuneo, although journalist Grégory Raymond reported that the transfers were initiated from Fortuneo (helpnetsecurity.com). Part of the funds has been blocked, the bank says the sums do not threaten its financial health, and the attacker is not attributed; ZachXBT stated he was confident it is not Lazarus Group (helpnetsecurity.com).

   Technical Details

   • ZachXBT first raised the case in a Telegram community alert, describing an unnamed EU entity that lost over $106 million from several centralized exchange accounts on November 1; the withdrawals were made in USDC and USDT, then swapped to ether, moved through instant exchanges and partly converted to Monero (helpnetsecurity.com).
   • A further $27 million in exchange withdrawals by the same actor was reported on November 3, bringing the total to $133 million (helpnetsecurity.com).
   • According to Raymond's sources, the fraudsters set the beneficiary name themselves, and falsified identities opened at crypto exchanges let each transfer pass the sender-to-account-owner name check (helpnetsecurity.com).
   • The bank states that the attack lasted several days in the view of ZachXBT, who suspects the total is larger when OTC activity is counted (helpnetsecurity.com).
   • No CVE, malware family, IP address, domain or hash was published in the sources reviewed.

   Remediation

   • The bank warns that phishing may follow, and customers have been told never to share login IDs, passwords, card numbers or SMS verification codes, and to confirm any suspicious message directly with their adviser (helpnetsecurity.com).
   • For defenders, the case points to third-party platform access and to beneficiary-name and outbound-transfer controls as areas to review; these are analytical recommendations, not bank statements.

   Conflicting Reports

   • The article reports Raymond's account that transfers were initiated from Fortuneo; Arkéa states that no entry was made through Fortuneo (helpnetsecurity.com).
   • The article reports losses of about $133 million, while the bank declines to confirm the amount and says it is too early for a final figure (helpnetsecurity.com).
3. infosecurity-magazine.com ↗ · pub. 09/11/2026 07:30 · coletado 09/11 08:00

   Crédit Mutuel Arkéa confirms attack via service provider; about $133m in suspected fraudulent transfers

   ler a análise desta fonte ocultar

   Crédit Mutuel Arkéa, a French banking group, stated on November 4 that it had been the victim of an attack that enabled fraudulent transactions, and said no customer funds were affected. According to the bank's FAQ as quoted in the article, the intruders entered its network through a service provider's platform and then moved money from the bank's own account to other banking institutions, which could have allowed conversion into cryptocurrency. The incident surfaced on November 2, when blockchain investigator ZachXBT alleged that an unnamed EU entity had lost about $106m from several centralized exchange accounts, and later reported roughly $27m in additional withdrawals. The bank says it is too early to quantify the total, that some funds have been frozen and recovery actions are underway, and that the amounts are unlikely to threaten its financial stability. A Spanish-language outlet (solutions-numeriques.com) reports that the group has not confirmed a figure of €118m but validates its order of magnitude, so the $133m total remains an investigator and press estimate.

   Technical Details

   • Initial access: the attackers reached the bank's network through a service provider's platform, per the bank's FAQ as quoted in the article. The provider is not named.
   • Abuse: the attackers used the bank's own account to send transactions to other banking institutions. The bank states that no customer accounts belonging to its federations or subsidiaries were used.
   • Cash-out path (ZachXBT tracing): USDC was swapped for ETH, moved to instant exchanges (WellWallet, Kyrrex and others), converted to XMR via Wagyu, and bridged across several chains.
   • Attribution: ZachXBT ruled out the Lazarus Group. Neither the bank nor authorities have attributed the attack.
   • Mapping (analyst): T1199 for the provider-based access and T1657 for the financial theft.

   Remediation

   • Customers: the bank urges vigilance against phishing in the aftermath of the incident and the publicity around it.
   • Defenders (analyst recommendation, not sourced): audit third-party access to payment and treasury platforms, require out-of-band approval for transfers from institutional accounts, and alert on outbound transfers to crypto-linked counterparties.
   • No vendor patch or CVE is involved. The research did not locate a public advisory with IOCs beyond the bank's FAQ as quoted in the article.
4. securityaffairs.com ↗ · pub. 08/11/2026 07:25 · coletado 08/11 08:00

   Crédit Mutuel Arkéa loses about €100M in cyber heist launched through a service provider's platform

   ler a análise desta fonte ocultar

   French cooperative banking group Crédit Mutuel Arkéa disclosed on 4 November 2026 that attackers executed fraudulent transfers out of the bank's own account, with losses the bank describes only as an order of magnitude of around €100 million ($112.6M) and that blockchain investigator ZachXBT puts at up to €118 million ($133M). The intrusion is attributed to access obtained through a third-party service provider's platform, and not through the Fortuneo online banking subsidiary; the bank rules out internal human error and calls the attack sophisticated. Funds were pushed to other banking institutions and converted into the USDC and USDT stablecoins, then laundered aggressively. The Paris prosecutor's cybercrime unit opened an investigation after a complaint from the bank, with France's cybercrime police leading the probe. Arkéa says customer assets were untouched, some transfers were delayed, the incident is closed and contained, and enhanced security measures were deployed. The bank states the stolen funds were not cryptocurrency as such, though they may have been converted into digital assets afterwards (computing.co.uk).

   Technical Details

   The initial access vector is a supply-chain / third-party access path: attackers reportedly reached the bank through a service provider's platform and then issued transfers from Arkéa's own institutional account to other banking organisations. ZachXBT reported that the actor swapped USDC for ETH, moved value through instant exchanges (WellWallet, Kyrrex), converted to XMR via Wagyu and bridged across multiple chains. He assesses with high confidence, from laundering indicators, that this is not Lazarus Group; the actor remains unidentified. According to BleepingComputer, the delay in public disclosure let roughly $30 million be laundered by 3 November, which may have prevented EU authorities from freezing those funds. ZachXBT first flagged a suspected theft of over $106 million from an unnamed EU entity on 2 November and named Arkéa late on 3 November (halborn.com). The root cause has not been disclosed by the bank (halborn.com).

   Remediation

   Financial institutions should review and constrain the privileges granted to third-party providers with access to payment and treasury platforms, enforce strong authentication and out-of-band validation on high-value interbank transfers, and monitor for anomalous outbound transfer volumes. Arkéa warns customers of a heightened risk of phishing following the publicity and urges them not to share sensitive information.

5. bleepingcomputer.com ↗ · pub. 07/11/2026 12:25 · coletado 07/11 14:00

   Crédit Mutuel Arkéa hit by supply-chain intrusion enabling ~€118M in fraudulent transfers laundered into stablecoins

   ler a análise desta fonte ocultar

   French cooperative bank Crédit Mutuel Arkéa disclosed on 4 November 2026 that attackers reached its network through a service provider's platform and initiated fraudulent transfers from the bank's own proprietary account toward other banking institutions, with funds then converted into cryptocurrency. Blockchain investigator ZachXBT first flagged the operation on 2 November, describing large unauthorized withdrawals from multiple centralized exchange accounts the previous day and estimating up to 118 million euros ($133 million) moved out as USDC and USDT stablecoins. The bank does not confirm that figure but validates the order of magnitude, states that part of the funds was blocked and that recovery steps are under way (usine-digitale.fr). Customer accounts and assets were not touched; the impact was limited to delays in executing certain transfers, and the bank says the incident is closed and under control. Arkéa ruled out human error on its side, called the intrusion sophisticated, and explicitly ruled out its subsidiary Fortuneo as the entry point. Judicial authorities and police are investigating the exact origin and modus operandi; no threat actor, malware or indicators have been published.

   Technical Details

   The initial access vector was a third-party service provider platform connected to Arkéa's network, making this a supply-chain compromise rather than a customer-side fraud. The attacker abused the bank's own institutional account to emit interbank transactions, then cashed out through centralized exchanges into stablecoins. ZachXBT noted that the absence of early public disclosure let roughly $30 million be laundered by 3 November, funds EU law enforcement could otherwise have frozen. No service provider has been named and no vendor advisory has been published; the provider itself has issued no public statement.

   Remediation

   Arkéa suspended certain systems during response and is restoring operations progressively. The bank warns of an elevated phishing risk in the wake of the publicity and advises clients never to share sensitive details by phone or email and to verify any suspicious message by calling their adviser directly. Institutions with similar third-party platform connections should review the privileges, network segmentation and transaction-authorisation controls granted to provider access paths.

6. gbhackers.com ↗ · pub. 05/11/2026 02:19 · coletado 05/11 03:00 primeiro registro

   Crédit Mutuel Arkéa Hit by Cyberattack, Over $133 Million Allegedly Stolen via Third-Party Provider Breach

   ler a análise desta fonte ocultar

   French banking group Crédit Mutuel Arkéa disclosed a cyberattack that resulted in fraudulent transactions, temporarily restricting customer transfers while the bank contained the incident and notified regulatory authorities. According to statements attributed to Arkéa, attackers compromised an external service provider's platform and used it to reach the bank directly, then used Arkéa's own institutional accounts—not customer accounts—to transfer funds to other financial institutions before laundering proceeds through cryptocurrency conversion. Blockchain investigator ZachXBT linked the bank to suspected losses exceeding $133 million, moved through crypto exchanges and converted into stablecoins, though Arkéa has only acknowledged the order of magnitude without confirming an exact figure. French prosecutors have opened an investigation assigned to the national cybercrime office (OFAC), and no threat actor has been publicly attributed to the attack.

   Technical Details

   The intrusion reportedly originated through a third-party service provider rather than direct compromise of Arkéa's own banking subsidiary Fortuneo, which the bank explicitly denied was the entry point. The compromised provider, exploited vulnerability, and any malware used remain unidentified in public reporting. This incident is distinct from customer-targeted banking malware that intercepts credentials, as it instead involved unauthorized institutional fund transfers using the bank's own accounts, subsequently laundered via cryptocurrency platforms.

   Remediation

   Arkéa introduced enhanced safeguards before restoring affected services and is working with authorities to freeze and recover stolen funds, with efforts ongoing. The bank warned customers about potential phishing attempts exploiting the incident and urged them never to disclose banking usernames, passwords, card numbers, or SMS validation codes, recommending verification of suspicious messages directly with an advisor.