French mutual bank Credit Mutuel Arkea says about €100 million (about $112.6 million) is missing after attackers went through a service provider's platform and used the bank's own account to send money to other banks, Reuters reported Thursday. The bank said it cannot yet say how much it will get back. For bank boards and corporate treasurers, the case shows that a supplier with a path into payment systems can be enough to move a nine-figure sum without touching a single customer account.
What Happened
According to Reuters, the attackers made "fraudulent transactions" from an Arkea account to other banks, and the money may have been converted into cryptocurrency through specialized platforms. The bank declined to name the service provider. A spokesperson rejected media reports that the group's online bank, Fortuneo, was the entry point, and said customer accounts were not involved and customer assets were not affected. The bank paused some transactions as a precaution, which delayed some transfers.
In a statement Wednesday evening reported by The Record, the bank called it a "sophisticated attack," said it was not caused by human error and said the loss was "absolutely not of a nature" to threaten its solvency. The bank also said part of the funds had been blocked and that work to recover the rest is continuing, according to AFP as published by France 24.
The theft first surfaced Monday through ZachXBT, a pseudonymous blockchain investigator who, The Record reported, estimated losses above $133 million based on withdrawals from crypto exchange accounts and apparent laundering transactions. The bank would not confirm that figure but said it could "validate the order of magnitude," The Record reported. No one has publicly identified the attackers.
Arkea, based in Brittany, has more than 5.8 million customers and €211.5 billion in assets, according to Reuters. It informed the European Central Bank, French banking supervisors and prosecutors. The Paris prosecutor's office said its cybercrime unit received the bank's complaint Wednesday and opened an investigation, Reuters reported. The prosecutor's office told AFP the case concerns an attack on an automated data processing system by an organized group.
Why It Matters
Payment and treasury flows that run through a third-party platform inherit that platform's security. In this case, the bank says, the attackers did not break into customer accounts at all; they reached an account the bank itself uses to move money.
The pattern is not limited to banks. The Primary Wire reported Monday, citing SecurityWeek, that Polymarket repaid traders about $3.9 million after attackers hijacked a vendor's script on its site.
For U.S. banks and companies, the practical questions are which outside platforms can start payments from the organization's own accounts, whether large transfers they start need a second approver, and whether transaction limits and monitoring apply to them as strictly as to employees.
What to Watch
- How much of the money the bank recovers, and how much the frozen crypto assets cover.
- Whether the bank, prosecutors or supervisors name the service provider, and whether other clients of that provider were exposed.
- Whether investigators attribute the attack, and any response from the European Central Bank or French supervisors on how banks oversee suppliers with access to payment systems.
