French bank confirms $133 million cyberattack tied to crypto
Security & Exploits ·
Crédit Mutuel Arkéa has confirmed a cyberattack resulting in roughly $133 million in losses, with the stolen funds suspected to have been converted into cryptocurrency.
The bank disclosed the breach after reports surfaced describing a cyberattack carried out through a third-party provider, according to wublockchain.xyz, which detailed that the misappropriated funds may have subsequently been moved into digital assets. Separately, theblock.co reported that the French bank confirmed the cyberattack, placing the suspected losses at approximately $133 million.
The incident has been described across multiple accounts as involving a vulnerability or compromise at a third-party vendor rather than a direct breach of Crédit Mutuel Arkéa's own core systems, though the exact mechanism of entry has not been detailed. The suspicion that the stolen funds were converted to cryptocurrency points to the use of digital-asset rails as a laundering or obfuscation step following the initial theft, a pattern that has recurred in other large-scale financial breaches.
Blockchain investigator ZachXBT has been cited as validating the scale of the suspected losses, lending independent corroboration to the $133 million figure circulating in initial reports. The matter has now been covered by four distinct sources, with consistent figures across accounts even as details about the attack vector and the destination of the converted funds remain only partially disclosed.
What remains unresolved includes the precise identity of the third-party provider implicated in the breach, the specific cryptocurrency or chains used to move the funds, and whether any portion of the $133 million has been traced, frozen, or recovered. It is also not yet clear whether regulators or law enforcement in France have opened a formal investigation, or what steps Crédit Mutuel Arkéa is taking to secure affected systems and reimburse any impacted parties. Further disclosures from the bank, along with on-chain tracing efforts, are likely to determine how much of the stolen amount can be recovered and whether additional institutions tied to the same third-party provider face similar exposure.