Crédit Mutuel Arkéa — hackers steal up to $133M via service provider access, launder funds as stablecoins
Severity: high · Patch status: no-fix-needed · Since 2026-11-07
French cooperative bank Crédit Mutuel Arkéa (5.8M members, €211.5B assets) suffered a sophisticated cyberattack in which an attacker accessed its network through a service provider's platform and used the bank's own account—not customer accounts—to initiate fraudulent transfers to other banking institutions, converting funds into USDC and USDT stablecoins. Blockchain investigator ZachXBT flagged large unauthorized withdrawals from centralized exchange accounts on November 1, estimating up to €118M ($133M) stolen, with $30M laundered by November 3 before freezing. The bank disclosed the incident November 4, saying it is 'closed and under control,' suspended certain systems, and warned customers of increased phishing risk. It did not confirm the exact amount but acknowledged the order of magnitude; investigations with judicial authorities and police are ongoing.
What to do
- Review and restrict third-party service provider access to payment and transaction systems; enforce MFA and least privilege on institutional accounts
- Monitor outgoing high-value transfers and crypto-exchange flows for anomalies; freeze suspicious transactions quickly with exchange and law-enforcement cooperation
- Verify all vendor/platform integrations for compromise and rotate credentials and API keys
- Alert customers to phishing risk following the incident and verify suspicious communications
- Coordinate with judicial authorities and police on fund tracing and recovery
Sources
All live incidents on Threat Watch
