Crédit Mutuel Arkéa — attackers exploited service provider platform to wire ~$133M, partly laundered via crypto
Severity: critical · Patch status: no-fix-needed · Since 2026-11-09 · CVE-2026-123158
Attackers siphoned an estimated $133 million (€118M) from French cooperative banking group Crédit Mutuel Arkéa by gaining access through the platform of one of its service providers and using the bank's own account to initiate fraudulent wire transfers to other banks. Blockchain investigator ZachXBT tracked over $133M in withdrawals from centralized exchange accounts starting November 1, withdrawn as USDC/USDT stablecoins, swapped for ether, moved through instant exchanges, and partly converted to Monero; he ruled out Lazarus Group. The bank confirmed the incident on November 4, suspended some transactions, and said part of the funds has been blocked. Customer accounts were not affected; a journalist linked the attack to online bank Fortuneo, which Arkéa denies. Phishing attempts may follow.
What to do
- Monitor for and block phishing campaigns targeting customers following the incident
- Review and harden third-party/service-provider access to payment initiation systems
- Enforce out-of-band verification and anomaly detection on high-value outbound transfers
- Coordinate with exchanges and law enforcement to freeze and trace remaining stolen funds
Sources
All live incidents on Threat Watch
