Hackers have raided French cooperative bank Crédit Mutuel Arkéa in a cyberattack that allowed fraudulent transactions worth up to $133 million, in a rare case of criminals stealing directly from a mainstream bank.

The bank says the attacker reached its network through a service provider's platform and then used Arkéa's own account to send transactions to other banking organisations and convert the money into cryptocurrency. Customer assets were not affected, the bank said, although some transfers were delayed while systems were suspended and checked.

How the heist unfolded

Reports of the incident first emerged on 2 November, when blockchain fraud investigator ZachXBT warned of a large unauthorised withdrawal from several centralised exchange accounts that had taken place a day earlier. He estimated the attacker may have taken up to 118 million euros, around $133 million, and withdrawn it as USDC and USDT stablecoins.

According to ZachXBT, the attacker then swapped stablecoins for Ether, moved funds through instant exchanges, converted some of it into the privacy coin Monero and bridged it across several blockchains. He also said the lack of public disclosure in the first days allowed the attacker to launder around $30 million by 3 November, money that European law enforcement might otherwise have frozen.

Crédit Mutuel Arkéa disclosed the incident on 4 November, telling customers it was contained and that operations were gradually returning to normal. In a statement, the bank said the incident had no impact on clients' assets and had merely caused a delay in the execution of certain transfer transactions.

Bank will not confirm the exact figure

The bank has not confirmed ZachXBT's estimate of the loss. Asked in a frequently asked questions page whether 118 million euros had been stolen, Arkéa said it did not confirm the figure and could only validate the order of magnitude. It acknowledged that the amount was significant and said some funds had been blocked.

Reuters reported the loss at around 100 million euros, or about $112.61 million, citing the bank. Arkéa is a major French banking and insurance group headquartered in Brest, Brittany, with more than 5.8 million members and 211.5 billion euros in assets.

The bank said the attacker did not enter through Fortuneo, its online banking subsidiary, and ruled out human error at the bank, describing the incident instead as a sophisticated attack. The Paris prosecutor's cybercrime unit has opened an investigation after receiving a complaint from the bank, with France's cybercrime police leading the probe.

Arkéa is working with judicial authorities and the police to establish the attack's exact origin and how it was carried out. The bank has also warned customers about an increased risk of phishing, urging them to stay alert for unsolicited messages and to verify any suspicious contact by calling their bank adviser directly.