The Arkea bank hack targeted French cooperative bank Crédit Mutuel Arkéa and enabled fraudulent transactions of up to $133 million. The bank suspended certain systems in response. It says customer assets remain unaffected.
Crédit Mutuel Arkéa has more than 5.8 million members and 211.5 billion euros in assets. Blockchain fraud investigator ZachXBT raised the alarm on November 2. He warned of a large unauthorized withdrawal from multiple centralized exchange accounts a day earlier.
According to ZachXBT, the attacker may have stolen up to 118 million euros ($133 million) and withdrawn it as USDC and USDT stablecoins (cryptocurrencies tied to a traditional currency). He says the lack of public disclosure let the attacker launder $30 million by November 3, which EU law enforcement would otherwise have frozen.
Arkéa disclosed the incident on November 4 and said it is “now closed and under control”. The bank says the attacker entered through a service provider’s platform, and it ruled out Fortuneo. The attacker then used Arkéa’s own account, not customers’ accounts, to move money to other banks and convert it into cryptocurrency.
The bank does not confirm the stolen amount and can only validate the order of magnitude. It acknowledged the amount was significant and some funds were blocked. Arkéa ruled out human error, called it a “sophisticated attack” and is working with judicial authorities and the police.
What does this mean for bank phone scams? The bank warned of increased phishing risk. It urges customers to avoid sharing sensitive details by phone or email, so call your bank adviser directly to verify suspicious messages. Treat every unexpected message as a possible phishing scam until you have checked it.
Read bleepingcomputer.com article for more information.
