Crédit Mutuel Arkéa, a major French bank, has confirmed a cyberattack that led to unauthorized transfers from its accounts. The bank stated that client assets remained unaffected, and the incident was contained. In a Wednesday statement, the bank emphasized that the attack only caused delays in certain transfers but reassured customers that their assets were secure.
Onchain investigator ZachXBT first reported the exploit on Nov. 2, estimating losses at over $133 million. He noted that the figure could increase due to ongoing transactions and potential over-the-counter deals. While Crédit Mutuel Arkéa did not confirm the exact loss amount, it acknowledged the scale of the incident and mentioned that some stolen funds had been blocked.
ZachXBT detailed the attacker's movements, including swapping USDC for ETH, using instant exchanges like WellWallet and Kyrrex, and converting funds into XMR via Wagyu. He also expressed confidence that the attacker was not linked to North Korea's Lazarus Group. The bank, with over 12,000 employees and 5.8 million customers, reported total assets of €211.5 billion ($238.1 billion).