A leading French banking group has moved to reassure customers that their funds are safe after reports emerged of a $133m heist.
Crédit Mutuel Arkéa issued a statement on November 4 confirming that it had been a victim “of an attack that enabled fraudulent transactions to be carried out.”
The hackers reached the bank’s network via the platform of a service provider, it added in an FAQ on the incident.
“The attackers used Crédit Mutuel Arkéa's own account to make transactions to other banking institutions, which then potentially allowed them to convert this money into cryptocurrency via specialized platforms,” it said.
“They did not, therefore, use customer accounts belonging to its federations or subsidiaries. We have communicated that this incident has no financial consequences for our customers. As soon as this attack was identified, our teams immediately activated the necessary security measures to contain the incident and prevent any further fraudulent activity against us.”
Read more on big-money heists: Brazilian Fintech Giant Sinqia Reveals $130m Heist Attempt
Suspicious Withdrawals Traced Across Multiple Exchanges
The incident first came to light on November 2 when blockchain investigator, “ZachXBT,” claimed in a Telegram post that an unnamed “EU entity” had lost $106m from “multiple centralized exchange accounts.”
ZachXBT ruled out the involvement of notorious North Korean hackers the Lazarus Group.
“Over the past 24 hours the illicit actor has been aggressively swapping USDC for ETH, transferring to instant exchanges (WellWallet, Kyrrex, etc), converting to XMR via Wagyu, and bridging across multiple chains,” they explained.
The investigator posted an updated the day after claiming to have spotted an additional $27m of fraudulent centralized exchange account (CEX) withdrawals.
“My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up,” they said. “No proper incident disclosure has resulted in $30m+ being laundered away which could have been frozen by EU law enforcement.”
However, Crédit Mutuel Arkéa noted in its FAQ that it was “still too early” to say for sure how much was taken.
“Our teams are continuing their work to precisely assess the financial consequences of this attack: some of the funds involved have been frozen, and other actions are underway to recover them,” it said.
“We can already confirm that the amounts involved are in no way likely to jeopardize the financial health and stability of Crédit Mutuel Arkéa.”
The bank urged customers to be on the lookout for potential phishing attempts in the aftermath of the incident and resulting publicity.
The news comes just days after North Korean hackers stole an estimated $6.3bn from cryptocurrency exchange Binance, in what has been described as the biggest theft of its kind ever seen.