French banking group Credit Mutuel Arkea has confirmed a “sophisticated attack” after a blockchain investigator reported that more than $133 million was stolen from it. The bank says attackers entered through a compromised service provider, that customer accounts were not touched, and that it can “validate the order of magnitude” of the reported loss without confirming the figure.
ZachXBT Traced Several Days of Withdrawals to Arkea
Blockchain investigator ZachXBT first reported the theft on Monday, 2 November, and later named Arkea as the alleged victim. He said the attack ran over several days and put the total above $133 million, basing the estimate on exchange withdrawals and laundering transactions he traced on-chain.
Arkea responded on Wednesday evening with a statement acknowledging the attack. The bank declined to confirm the exact amount but said the reported scale was in the right range. It added that the final loss has not been established.
The two accounts differ in kind. ZachXBT’s figure is an outside estimate built from public blockchain data and exchange activity, while Arkea’s statement confirms the nature and rough scale of the incident without endorsing the number. Because the bank calls the loss not yet final, the total could still move as frozen assets are recovered and investigators finish tracing the laundering transactions.
How Attackers Reached the Bank Through an Unnamed Service Provider
According to Arkea, the intruders compromised a service provider that the bank has not named. They used that access to reach the bank’s own account and then made transfers to other banking institutions. Those transfers let them convert the money into cryptocurrency through specialised platforms.
Arkea Rejects Reports Pointing to Its Fortuneo Subsidiary
French media reports had suggested the attackers entered through Fortuneo, Arkea’s online banking subsidiary. The bank disputed that account. Its description places the initial compromise at the supplier, not inside its own retail banking platforms.
Arkea Says Customer Accounts and Solvency Are Unaffected
Arkea says customer accounts were not accessed and customer assets are not affected. It also says the loss is “absolutely not of a nature” to threaten the group’s solvency. The group reported total assets above EUR 237 billion, which puts the estimated theft at a small fraction of its balance sheet.
Frozen Assets and a Judicial Probe Follow the Arkea Theft
Arkea says it has activated crisis procedures and describes the incident as under control. Some of the assets that were converted have been frozen, and the bank says it is working to recover the remainder. It is cooperating with judicial and police authorities to establish how the attack originated and what method was used.
The detail that the proceeds moved through bank-to-bank transfers before reaching crypto platforms gives investigators two trails to follow: the traditional banking records at the receiving institutions and the on-chain movements ZachXBT traced. Freezing of converted assets suggests at least part of the money was caught while still sitting on platforms that can act on a request.
Arkea’s Supplier Link Mirrors Third-Party Access in Large Financial Thefts
The Arkea account fits a pattern in which attackers target a supplier with trusted access rather than the bank directly. The supplier’s identity, the type of access it held and the means by which attackers took control of it have not been disclosed, and those facts will determine how far the lesson extends to other institutions that use the same provider.
Several questions remain unanswered, including how long the attackers held access before the first transfers and whether the provider serves other financial firms. Arkea has so far offered no timeline beyond the several days of activity ZachXBT described, and the authorities have not announced attribution.
