Crédit Mutuel Arkéa, a large French banking group, confirmed on Wednesday that it suffered a sophisticated attack, The Record reported. The bank said attackers first broke into an unnamed supplier. They then used the bank's own account to send money to other banks. ZachXBT, a pseudonymous blockchain investigator, first reported the theft on Monday. He later named Arkéa as the alleged victim and said the attack ran for several days. He estimated the loss at more than $133 million, based on crypto exchange withdrawals and transfers meant to hide the money's trail.
Arkéa did not confirm that figure. It said it could validate the order of magnitude, and that the final loss is not yet set. The bank said some of the money, once turned into cryptocurrency, has been frozen, and it is working to get the rest back. It said customer accounts were not accessed and customers' assets are not affected. The bank has not named the supplier or said how the attackers got in. It denied French media reports that its online bank, Fortuneo, was the way in. Arkéa said it is working with police and judicial authorities to find the origin and method of the attack.
Arkéa says the attackers reached the bank through a service provider's platform, and that human error was not the cause. For teams that let outside vendors touch payment accounts or core systems, the case shows how a supplier can become the way into a bank. The bank says the loss is far too small to threaten its financial health.