Hackers steal up to $133m from French bank Arkéa
Crédit Mutuel Arkéa says an attacker used its own account to move money, and that customer assets were not affected, according to BleepingComputer.
The facts
- Crédit Mutuel Arkéa was hit by a cyberattack that allowed fraudulent transactions of up to $133 million, according to BleepingComputer. The bank suspended some systems in response.
- Blockchain investigator ZachXBT first flagged the theft on November 2 and estimated up to 118 million euros ($133 million) was taken and withdrawn as USDC and USDT. The bank does not confirm that figure and says it can only validate the order of magnitude.
- The bank says the attacker got in through a service provider's platform and used the bank's own account, not customers' accounts, to send money to other banks and convert it into crypto. It says customer assets are unaffected and some funds were blocked.
- ZachXBT said the lack of public disclosure let the attacker launder $30 million by November 3, funds EU law enforcement would otherwise have frozen. The bank disclosed the incident on November 4 and is working with police and judicial authorities.
Case notes · Danny's take
Why it matters
The money did not leave through a customer's phone. It left through a supplier. That is the pattern to remember: you can lock your own front door and still lose the house because a contractor had a key. It also shows how fast stolen bank money can become stablecoins, which is exactly where on-chain investigators can follow it. And the timing claim matters. If ZachXBT is right, silence for a day or two gave the attacker room to cash out.
For traders
Watch the on-chain trail, not the headlines. Stablecoin issuers can freeze tokens, so look for whether any of the stolen USDT or USDC gets frozen and how much has moved on. Treat the 118 million euro figure as unconfirmed until the bank or the authorities give a number.
For builders
Third-party access is the soft spot. Audit what your service providers can reach, limit what any one account can move, and set alerts for unusual outbound transfers. Fast disclosure also matters, because freezes only work if someone is told in time.
Not financial advice. Do your own investigation.
This story was summarised with AI from BleepingComputer's reporting and checked against our editorial policy. Danny's take reflects his views. Disclaimer.
Danny Walter
Founder of Moon Republic, Volt Terminal and Moon Republic Academy. Author of The Market Is a Crime Scene and After the Applause.