French bank Crédit Mutuel hacked: $133 million in crypto stolen

The French bank Crédit Mutuel Arkéa has confirmed that it has been the victim of a cyber attack in which fraudulent transactions were carried out. According to blockchain researcher ZachXBT, more than $133 million worth of cryptocurrencies disappeared in the incident.

The bank confirms the attack, but has not yet disclosed how much money has actually been looted.

The revelation comes after ZachXBT raised the alarm earlier this week about a large-scale theft from a yet unknown European financial institution. In the meantime, he has designated the French bank as a suspected victim.

Crédit Mutuel Arkéa confirmed to CoinDesk on Wednesday that the attack facilitated fraudulent transactions. According to the bank, the situation is now under control.

A spokesperson emphasizes that customers do not suffer any financial consequences and that their interests are fully protected.

In order to prevent further damage, the bank has temporarily halted certain transactions. The competent authorities have also been informed. The investigation into the consequences of the attack is still ongoing.

Exactly how much money disappeared remains unclear. The bank has not disclosed whether the affected funds originally consisted of traditional currency or crypto.

The French banking group manages more than $250 billion in assets and has been preparing for a larger role in the crypto sector for some time. In May, it was announced that Crédit Mutuel Arkéa had applied for a license under the European MiCA rules to offer crypto services to individuals and financial institutions.

The first indications of the theft came out on Monday. ZachXBT then reported that more than $106 million in crypto coins had disappeared from a European financial institution.

A day later, he discovered another $27 million in suspicious withdrawals at crypto exchanges. This raised his estimate to more than $133 million.

According to the investigator, the actual damage may even be higher. It is also possible that transactions have been carried out outside the regular crypto exchanges, which have not yet been included in his calculations.

Blockchain analysis company Bitquery has examined some of the cash flows separately. It shows that USDC was withdrawn from accounts at Kraken, Crypto.com and OKX within approximately 21 hours for $108.8 million on 1 and 2 November.

The money was then spread over hundreds of digital wallets. A large part was quickly exchanged for Ethereum (ETH).

Within four hours alone, about 63 million dollars of stablecoins were converted into 27,553 ETH. That makes it harder to block the money. The issuer of USDC can freeze suspicious funds, while with Ethereum this is not possible in the same way.

Crypto exchanges are also involved in the investigation into the stolen funds. Crypto.com confirms that blocked the funds associated with the attack. According to the exchange, customers' funds are safe and remain accessible.

Blockchain analytics firm Bitquery also discovered that 396 Ethereum (ETH) had been sent to a Kraken address. Whether Kraken froze this money and who is behind the receiving account is still unclear. There are no indications that the crypto exchanges themselves have been hacked.

The case follows a series of major attacks in the crypto sector, including the recent hack at Binance that captured $6.3 billion. The FBI holds North Korean hackers responsible for that attack.

According to researcher ZachXBT, North Korea does not appear to be involved in the French bank. He points out clear differences in the way the stolen money was moved. This does not correspond to the well-known working method of the North Korean hacker group Lazarus.

Who is behind the attack and how the perpetrators gained access to the money is not yet known.