Arkéa, parent of Fortuneo, reportedly lost over €100 million in a cyberattack

On November 1 at 12:25 UTC, a first withdrawal leaves an account opened on OKX, a cryptocurrency exchange. Forty-four minutes later, another follows at Kraken. Over several days, tens of millions of dollars in stablecoins, cryptocurrencies pegged to the dollar, leave exchanges this way. Three days later, the trail leads to a French bank.

On November 4, Crédit Mutuel Arkéa, a Breton banking group and the parent company of the online bank Fortuneo, confirmed to AFP that it had been the victim of a cyberattack that enabled "fraudulent transactions." According to the bank, the incident is "now under control" and has "no financial consequences" for its customers. It did not give a precise amount. That evening, it merely "validated the order of magnitude" of the €118 million reported in the press. As a precaution, some transactions, including transfers, were temporarily suspended. In a statement, the bank said operations are "gradually resuming." The Banque de France (France's central bank) was informed, according to Le Télégramme.

How did the trail lead to a Breton bank?

The story did not come from a press release, but from an investigation carried out in public on the blockchain. On November 2, ZachXBT, a pseudonymous investigator known for tracking cryptocurrency thefts, reported a loss of more than $106 million suffered by a European Union "entity." He then spotted about $27 million in additional withdrawals and raised the total to more than $133 million, or about €118 million. He then named Crédit Mutuel Arkéa as the presumed victim. According to him, the actual figure could be higher once over-the-counter trades are taken into account.

Meanwhile, the analytics firm Bitquery traced $108.8 million in USDC (a dollar-pegged cryptocurrency) withdrawn in 21 hours from accounts opened at Kraken, Crypto.com and OKX. However, it could neither confirm the total loss nor identify the victim, CoinDesk reports. A large share of the funds was converted into ether. According to several media outlets, another part was converted into Monero, a cryptocurrency designed to obscure transaction trails. Crypto.com says it has frozen funds linked to the incident. As for ZachXBT, he says he is highly confident that the North Korean group Lazarus is not behind it, because the money did not move as it does in the group's usual attacks.

Did the online bank Fortuneo serve as the entry point?

The bank initially left this question unanswered. Journalist Grégory Raymond (The Big Whale) claims, based on anonymous sources, that the fraudulent transfers originated from Fortuneo, which has more than one million customers. On the evening of November 4, Arkéa denied this: according to the bank, the attackers did not go through Fortuneo but through a service provider's platform, to directly reach an account belonging to the group. Before this denial, Le Figaro, cited by Actu17, claimed that the fraudsters had targeted Fortuneo's own funds, not customer deposits. A source cited by franceinfo says that checking accounts and savings accounts are intact.

Grégory Raymond's sources describe a modus operandi that has not been confirmed at this stage. Transfers were reportedly issued from the bank to accounts opened under false identities on cryptocurrency platforms, despite identity checks. The funds were then allegedly converted into stablecoins, then withdrawn to external wallets. Kraken says its systems were not compromised. It remains to be seen how the fraudsters were able to issue these transfers. Two hypotheses are circulating: a compromise of the payment systems that went unnoticed for several days, or an internal human failure, along the lines of "CEO fraud." Neither is confirmed.

Group customers: what to do

For its 5.6 million customers, the bank is trying to be reassuring. At this stage, the main risk comes rather from scammers who take advantage of this kind of news to target worried customers.

• Hang up if a supposed adviser or "fraud department" offers to "secure" your account. Then call back the number shown in your banking app.
• Never share a code received by text message, or your login credentials.
• Forward suspicious text messages to 33 700 and report attempts on cybermalveillance.gouv.fr.
• If a transfer is blocked, it may be due to the precautionary suspension announced by the bank: there is no need to redo it through another channel.

Clubic notes that the Arkéa group is separate from Crédit Mutuel Alliance Fédérale, which owns CIC and is not affected.

Why did the bank's alerts miss it?

For businesses, the lesson goes beyond the Arkéa case. The withdrawals were spread over several days. According to Clubic, ZachXBT estimates that more than $30 million could have been frozen if the alert had been raised earlier. Why did the bank's alert thresholds not trigger? France 3 Bretagne raises the question, which remains unanswered for now. The coming days should reveal how much was actually lost, where the transfers originated and whether a complaint has been filed.