European Bank Suffers $133M Exploit Linked to Crypto

A prominent French cooperative lender suffered a cyberattack resulting in unauthorized transfers from its proprietary accounts, with the stolen fiat subsequently converted into digital assets. Independent blockchain researcher ZachXBT estimates the total digital asset laundering exceeds $133 million.

The financial institution, Credit Mutuel Arkea, confirmed the breach on Wednesday. The attackers infiltrated the bank by compromising a third-party service provider's platform, granting them direct access to the lender's internal systems. From there, the malicious actors routed transactions from the institution's own treasury to external banks before utilizing specialized platforms to swap the money into cryptocurrency.

Client funds remain intact. The institution clarified that no federation or subsidiary customer accounts were compromised. According to a Reuters translation of the bank's website statement, “This incident has had no impact on (customer) assets and has only caused a delay in the execution of certain transfers,” prompting the temporary suspension of some transaction types as a safeguard.

Representatives refuted reports from the French press that the attackers breached the system through the online banking division, Fortuneo. Instead, the firm described the exploit as “a sophisticated attack from the outside,” dismissing any speculation of human error.

Tracking the Stolen Assets

ZachXBT initially reported the exploit on Monday without naming the victim, noting that an unknown European Union entity lost more than $106 million from various centralized exchange accounts on November 1. The stolen funds were primarily withdrawn in the stablecoins USDC and USDT before being converted into ether and scattered across multiple blockchain networks.

A subsequent update from the researcher identified another $27 million in exchange withdrawals, raising the estimated minimum loss to $133 million. ZachXBT alleged the theft “occurred for multiple days” and suggested that the true total may be higher once over-the-counter transaction volume is factored in. The researcher expressed high confidence that the exploit was not executed by North Korea’s Lazarus Group, a syndicate recently linked by blockchain analysis firms to a separate $6.34 billion Binance hack.

Financial Impact and Recovery

Credit Mutuel Arkea has not verified ZachXBT’s exact timeline or total. When questioned about the $133 million figure, equivalent to 118 million euros, the bank declined to confirm the exact sum, stating it could only “validate the order of magnitude.”

News agencies reported varying estimates, with AFP citing a provisional figure of approximately 100 million euros, while a spokesperson told Reuters that losses were under $133 million. “It is still too early to give a final figure,” the spokesperson noted.

The lender stated that a portion of the stolen funds is currently frozen, and recovery efforts are actively underway. Management emphasized that the financial loss is “absolutely not” significant enough to jeopardize the bank's overall stability. The wider Credit Mutuel group subsidiary manages 211.5 billion euros, or roughly $238 billion in assets, serves 5.8 million clients, and posted a net profit of 230 million euros in the first half of the year.

Law enforcement and judicial authorities are investigating the breach alongside the bank, which has also alerted its internal supervisors. Meanwhile, the institution advised its clientele to remain vigilant against potential phishing attempts in the aftermath of the incident. In a separate security event this week, Brazil’s Mercado Bitcoin was also forced to freeze platform deposits and withdrawals.