When we talk about cyber attacks on banks, it is easy to imagine empty accounts or clients unable to access their money. However, the security of a financial institution encompasses much more than the applications we use to check balances. It also depends How the operation is authorizedWho can run them, and what controls come into play when something doesn’t fit This is where the problem takes on another dimension: an intrusion can compromise certain processes meaning all of the customers’ savings are at risk.
The latest case we hear takes us to France, where one of its banking groups has had to admit a security incident of considerable scope. We are talking about Crédit Mutuel Arkéa, an entity with more than 5.8 million members and clients that confirmed today, November 4, that it was the victim of a cyber attack that allowed fraudulent operations to be carried out. The potential scale is significant: blockchain researcher ZachXBT estimated that over $133 million, around 118 million euros were stolen. However, the bank has assured Reuters that its losses will be small and has not yet communicated a specific figure.
We have to go back to November 2nd to understand how this case came to light. That day, ZachXBT warned of suspicious activity related to a European entity whose identity it has not yet disclosed. The researcher expanded his hypothesis over the following days until he pointed out November 4 Credit Mutuel Arkéa. In a later official explanation, the group explained that the attackers accessed its digital bank through one of its providers’ platforms, rather than through Fortunio. From Arkéa’s own account they performed transfers to other banking entities, which were subsequently able to convert the money into cryptocurrency.
What do we know about attacks and compromised funds?
A peculiarity of this case is that we can follow parts of the money trail without knowing the full extent of the attack. ZachXBT initially identified more withdrawals than this 106 million dollars And then another 27 million locations. Bitquery’s research offers a second perspective: its analysts tracked the movement of $108.8 million in USDC, distributed among 15 cryptocurrency addresses in about 21 hours. However, the firm itself admitted that it was not able to identify the account holder or verify the total amount reported.
Tracking these activities allows us to understand an additional difficulty: tracking funds does not necessarily mean being able to recover them According to Bitquery, withdrawals were made from Kraken, Crypto.com and OKX accounts in USDC, a cryptocurrency designed to maintain its value close to the dollar. Much of this is converted into Ether, an asset that cannot be directly blocked by the issuing entity. However, the investigation also identified control measures: Tether froze about $1.14 million in USDT, and Crypto.com confirmed to CoinDesk that it had blocked new fund movements related to the incident. It is not known how much money can be recovered for now.
While investigators try to piece together what happened, there’s another issue that directly affects consumers: what happened to their accounts. According to Crédit Mutuel Arkéa, its funds are protected because the attackers used an account belonging to the group and not its clients. Recognized operational consequences were limited to delays in certain transfers, and the entity confirmed that virtually all operations had resumed their operations on the morning of November 4. He also warned Possible phishing attemptsA practice whereby criminals seek to obtain confidential information by posing as trusted entities.
The episode comes in a week where other European companies have also been hit by computer attacks A number of supermarkets in Belgium, Sweden and Ireland have seen their refrigeration systems altered, forcing food to be removed from sale. These are separate phenomena, which have no proven relationship, but they reflect the dependence of day-to-day activities on technology. In the financial sector, the European Union is implementing the DORA regulation from January 2025, which establishes obligations to manage technical risks, including those related to external suppliers, and strengthens the ability of entities to respond to digital incidents.
Picture | Credit Mutuel Arkéa
In Xataka | Greenland becomes key part of European internet: Brussels plans an underwater cable that bypasses the US
