Crédit Mutuel Arkéa says the attacker used its own account, not customers'

Two kinds of account, one open question

A bank holds two kinds of money. Customers' balances sit in their accounts. The bank also has an account of its own, which it uses to deal with other financial institutions. Crédit Mutuel Arkéa says the second kind was the one used in a recent attack.

That is the bank's account of events, and the investigation is still running. The bank has not named the supplier or described how the attacker got in. Much of what follows is therefore what the bank says, not what has been proven.

What the bank has said

Arkéa is a French cooperative bank. BleepingComputer reports that it serves more than 5.8 million members and holds 211.5 billion euros in assets. The bank says the attacker used Arkéa's own account to start transactions with other banking organisations. It says clients' assets were not affected. It also says some transfers were delayed.

On November 4, the bank said the incident was closed and under control, and that services were gradually returning to normal. It also warned customers of a higher risk of phishing, meaning fraudulent messages. The bank did not say why it issued that warning, so a link to the attack should not be assumed.

The bank's FAQ gives a little more. It says the attacker reached the bank's network directly through a service provider's platform. It named Fortuneo as not being the route. It said staff error played no part and called the attack "sophisticated."

How the money moved, and what is not known

The bank says the attacker used its own account to transact with other banks and to convert funds into cryptocurrency. That is all the bank has disclosed about how the money moved. By its account, the attacker used the bank's own account to send payments, not customers' accounts.

Some general background helps here. It is not a fact of this case. A bank's own account with other institutions is typically the channel through which it settles payments with them. A supplier platform with a path toward that channel is therefore a valuable entry point for an attacker. The bank has not said whether that applies here, or how the attacker gained control.

More general background: a trusted connection can inherit access that the supplier was never meant to hold. That is why a supplier's platform can matter far beyond the supplier's own role. The sources do not say whether that happened here.

The sources do not describe the entry technique. They do not say what the provider's platform could reach, or how funds went from the bank to exchanges. The bank says it is working with judicial authorities and police to establish the origin and method. BleepingComputer says it asked the bank for more detail and had no reply at publication.

The amount is disputed

Blockchain investigator ZachXBT first reported the incident on November 2. He pointed to a large withdrawal from several centralised exchange accounts the day before. He estimated the attacker may have taken up to 118 million euros ($133 million), paid out as USDC and USDT, two dollar-linked digital coins.

The bank does not confirm that figure. Asked directly, it said it "can only validate the order of magnitude." It called the amount significant and said some funds were blocked. The sources do not say whose funds were in the exchange accounts ZachXBT described. They also do not confirm that those exchange withdrawals are the same transactions the bank describes.

One investigator's point about disclosure

ZachXBT made a further claim about this case. He said the lack of public disclosure let the attacker launder $30 million by November 3. He said EU law enforcement would otherwise have frozen that money. The bank disclosed on November 4.

This is the investigator's assessment. Neither the bank nor the authorities have confirmed it. The sources give no reason for the timing of the bank's disclosure.

Still, it points to a general trade-off. Exchanges and other banks can act on a theft only once they know about it. Any institution weighing when to speak publicly faces that tension, and none of the sources suggest Arkéa chose silence.

Questions to put to your team

First, which suppliers have a connection that can reach systems moving money, and what can each do once inside? Ask for the list, not a policy statement.

Second, are your own accounts, treasury links and payment credentials watched as closely as customer accounts? Here the bank says the money moved through its own account.

Third, who can alert other banks, exchanges and law enforcement in the first hours, and who decides? Write the names down before an incident.

Fourth, does your supplier contract require fast notice of a breach on their side, and a way to cut their access at once?

The Arkéa case is one incident, and key facts are missing. The question it raises still applies to any organisation: which trusted connection could reach your own money?

Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: BleepingComputer.