French Lender Crédit Mutuel Arkéa Says Cyberattack Diverted About €100 Million

The bank said the attackers got into Arkéa's own account and used it to send transfers to other banks. The money was then converted into cryptocurrencies on specialised platforms. Arkéa said the attack had been contained, that customer accounts were not touched and that clients suffered no losses. It said part of the money has been blocked and it is working to recover the rest.

The theft comes days after a $6.3 billion hack of the Binance exchange. It is a large loss for a mid-sized European lender, and it shows how quickly money taken through banking channels can be moved into crypto, where it is harder to recover.

Arkéa said it had ruled out human error. It gave no details of how the attack was carried out or who was behind it, and no group has claimed responsibility. Some transactions were suspended as a precaution, and the bank said most resumed the same morning after security checks. The only effect on customers was a delay to some transfers, it said, and no customer data was stolen. It warned clients to watch for phishing attempts.

The bank said the amount involved, which it is still assessing, was not large enough to threaten the group's financial health. Arkéa reported a net profit of 230 million euros for the first half of the year.

The regional newspaper Le Télégramme put the losses at $133 million (118 million euros). Arkéa did not confirm that figure but said it was the right order of magnitude. According to Agence France-Presse, the bank denied press reports that the attackers had entered through its online bank Fortuneo. It said they did not get in through Fortuneo but through a platform run by a service provider, which it did not name.

The Paris prosecutor's cybercrime section said the bank filed a complaint on Wednesday morning and that it opened an investigation straight away. The case concerns an "attack on an automated data processing system by an organized group" and has been assigned to the Office anticybercriminalité, the national police cybercrime unit.

The fraud first came to light earlier in the week through ZachXBT, an anonymous investigator who traces funds on public blockchains. He said the stolen money had been passed through several accounts opened on crypto exchanges.

Arkéa is based near Brest. It includes the Brittany and South-West federations of Crédit Mutuel and several specialised subsidiaries. It belongs to the Confédération nationale du Crédit Mutuel but runs with a large degree of independence from the network's central body.

The bank has not said how much of the money has been frozen so far. The amount it can recover from the exchanges will determine its final loss.