French bank Crédit Mutuel Arkéa hit by heist via third-party service provider
- Severity
- High
- Sources
- 1
What happened
Crédit Mutuel Arkéa disclosed on 4 November that an attacker entered via a service provider's platform and used Arkéa's own account to push fraudulent transactions to other institutions. Funds were reportedly swapped to ETH, moved through instant exchanges, converted to XMR and bridged across chains, and about $30 million was laundered by 3 November. Reported losses vary between $133 million, €100 million and €118 million, and the bank has not confirmed any figure. Defenders should review third-party platform access and monitor outbound interbank transfers, and the bank warns of increased phishing risk. No CVEs are mentioned.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Be wary of unsolicited messages claiming to be from Crédit Mutuel Arkéa, and do not share sensitive information.
- Watch for further updates from the bank, which says its assessment of the incident is ongoing.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Threat actors
Companies