Hackers pull off $133M French bank heist via service provider

French banking group Crédit Mutuel Arkéa suffered a sophisticated cyberattack that used a service provider’s platform to gain direct access to the bank’s network. The attacker then used an Arkéa-owned account - not customer accounts - to send unauthorized transfers to other financial institutions and convert funds into cryptocurrency. Blockchain investigator ZachXBT estimated that as much as €118 million, or $133 million, was taken and exchanged for USDC and USDT stablecoins. Arkéa has not confirmed that figure, but acknowledged that the amount was significant and said some funds were blocked. ZachXBT also reported that roughly $30 million had been laundered before the incident became public.

Arkéa disclosed the breach on November 4, saying it was contained and that services were gradually returning to normal. The bank said customer assets were unaffected, though some transfers were delayed, and warned customers to watch for phishing attempts that might exploit the incident. It ruled out human error and identified a service-provider platform as the route into its systems, while excluding its subsidiary Fortuneo. The bank is working with police and judicial authorities to determine how the attack was carried out and where it originated. The incident underscores how access through an external provider can enable major financial theft, while delays in disclosure may give attackers time to move funds beyond the reach of investigators.