French banking group Crédit Mutuel Arkéa has confirmed it was hit by a cyberattack after a blockchain investigator estimated that hackers stole more than $133 million.
The attackers compromised a service provider’s platform to gain access to the group and make transfers from the bank’s own account, Arkéa said in a statement Wednesday.
The bank said customer accounts had not been accessed and their assets would not be affected.
Arkéa did not confirm the estimated loss but said it could “validate the order of magnitude”. The final loss had yet to be established, it added.
“As soon as the attack was detected, the necessary measures were taken under existing crisis procedures. The incident is now under control,” the bank said.
Pseudonymous blockchain investigator ZachXBT first reported the incident on Monday and later identified Arkéa as the alleged victim. He estimated the theft at more than $133 million, based on withdrawals from cryptocurrency exchange accounts and transactions intended to launder the assets.
Arkéa disputed French media reports that the attackers had gained access through its online banking subsidiary Fortuneo.
It described the attack as sophisticated and said it was not the result of human error, without providing further details.
The attackers transferred money to other banks, potentially allowing them to convert it into cryptocurrency through specialised platforms, Arkéa said. Some converted assets had been frozen, and the bank was working to recover the rest.
The group said the loss would not threaten its solvency or financial health. It added that it was working with judicial and police authorities to establish the origin and method of the attack.
