Hackers pull off $133 million French bank heist via service provider

The attacker did not begin by taking money from customer accounts. According to Arkéa, the attacker reached the bank’s network through a platform operated by a service provider. That access mattered because it provided a path into systems connected to the bank’s operations.

After getting inside, the attacker used Arkéa’s own account to initiate transactions with other banking organizations. The funds were then converted into cryptocurrency. The bank has not identified the service provider publicly in the supplied account, but it specifically ruled out Fortuneo.

Arkéa said the incident was sophisticated and ruled out human error at the bank. It is working with judicial authorities and police to determine the attack’s exact origin and method. The bank said the incident was closed and under control, while some systems and transfer operations gradually returned to normal.

ZachXBT estimated that the attacker may have stolen up to 118 million euros, equivalent to $133 million. Arkéa did not confirm the exact figure, but it acknowledged that the amount was significant and validated its broad order of magnitude.

Compared with Arkéa’s 211.5 billion euros in assets, 118 million euros is about 0.056%. Put another way, the suspected amount is roughly one part in 1,800 of the bank’s reported assets. That comparison describes scale, not the bank’s immediate loss or ability to pay customers.

The distinction matters because the article says customer assets were unaffected. The attacker used the bank’s own account, and some funds were blocked. Arkéa suspended certain systems and delayed some transfers, but said operations were gradually returning to normal.

A cyberattack is an unauthorized effort to access, disrupt, or manipulate computer systems or digital accounts. It matters because attackers can abuse trusted access, create fraudulent transactions, or interrupt normal services without physically entering a bank.

In this incident, the attacker reached Arkéa’s network through a service provider’s platform. The attacker then used Arkéa’s own account to send transactions to other banking organizations and convert funds into cryptocurrency. The article says customer accounts were not used, and customer assets remained unaffected.

That difference changes the immediate risk. Direct customer-account theft would target individual balances or credentials. Here, the bank faced fraudulent activity from an account belonging to the institution itself, plus delays in certain transfers. Arkéa suspended some systems, warned about phishing, and worked with police and judicial authorities to establish how the attack occurred.

The attacker’s use of Arkéa’s own account created a route for large transactions to leave the bank through other banking organizations. This was not a withdrawal from individual customer accounts. Instead, the attacker misused an institutional account and the banking relationships connected to it.

The article says the funds were sent to other institutions and converted into cryptocurrency, specifically stablecoins such as USDC and USDT. ZachXBT reported that the attacker may have taken up to 118 million euros. Some funds were blocked, but the exact amount remains unconfirmed.

The incident forced Arkéa to suspend certain systems and caused delays in some transfer transactions. The bank said customer assets were unaffected and that the incident was closed and under control. It also warned customers about increased phishing risk while investigations continued with police and judicial authorities.

The central actor was an attacker who reached Arkéa’s network through a service provider’s platform. Crédit Mutuel Arkéa was the targeted bank and the owner of the account used for the transactions. The service provider’s platform appears in the access path, while the article does not name that provider and rules out Fortuneo.

Cryptocurrency exchanges were involved because ZachXBT reported an unauthorized withdrawal from multiple centralized exchange accounts. The attacker allegedly moved funds as USDC and USDT. ZachXBT, identified as a blockchain fraud investigator, publicized the activity and warned that the lack of disclosure allowed further laundering.

Arkéa suspended certain systems, notified customers, blocked some funds, and cooperated with authorities. Police and judicial authorities are investigating the attack’s origin and method. The article also says BleepingComputer sought more information from Arkéa but had not received a response.

Stablecoins are digital tokens designed to maintain a relatively stable value, commonly around a traditional currency such as the U.S. dollar. In this incident, the attacker allegedly converted funds into USDC and USDT after using Arkéa’s account. That conversion created a digital form that could move between cryptocurrency services.

ZachXBT reported unauthorized withdrawals from multiple centralized exchange accounts and said the attacker may have taken up to 118 million euros. The investigator later said the attacker had laundered $30 million by November 3. The article does not describe every transfer route or laundering technique.

Some transfers may be frozen when participating services or authorities identify links to the attack and restrict movement. Arkéa acknowledged that some funds were blocked. ZachXBT said earlier public disclosure might have allowed EU law enforcement to freeze funds that were otherwise laundered, showing why rapid reporting can matter.

Normally, a bank transfer between institutions passes through several stages: an authorized user creates it, internal systems authenticate and approve it, payment systems transmit it, and the receiving institutions settle and reconcile it. The exact process varies by payment network and country. The supplied article does not identify which controls failed at Arkéa.

Banks commonly use role-based access, multi-person approval, transaction limits, monitoring for unusual behavior, and checks on recipients and payment instructions. Large or unusual transfers may require extra review or temporary holds. These controls are designed to prevent one compromised account or session from moving very large sums unchecked.

The incident shows why those layers matter. The attacker used Arkéa’s own account to send funds to other institutions and convert them into cryptocurrency. Arkéa suspended certain systems, blocked some funds, and is investigating the attack’s method. The article does not say which authorization or settlement control was bypassed.