Crédit Mutuel Arkéa said in a press notice that the attackers were able to make transfers using the bank’s own account after compromising an unnamed supplier. The statement stressed customer accounts were not accessed and that the incident would not impact customers’ assets.
Details about the incident were first reported on Monday by ZachXBT, a pseudonymous American blockchain investigator who subsequently named Arkéa as the alleged victim and said the attack had run over several days. ZachXBT estimated the size of the theft at more than $133 million, based on withdrawals from cryptocurrency exchange accounts and transactions intending to launder the assets. In its statement Wednesday evening, Arkéa declined to confirm the estimated loss figure but said it could “validate the order of magnitude.”
