Crédit Mutuel Arkéa, a French bank, says attackers used its own account to move up to $133 million. Customer money was not touched, but scam messages may follow.
Hackers got into a French bank through an outside company that serves it and sent out a huge sum of money. Crédit Mutuel Arkéa says the thieves used the bank's own account, not customers' accounts. An investigator estimates the theft at up to 118 million euros, about $133 million. The bank says customer assets were not affected.
Reports first appeared on November 2. Blockchain fraud investigator ZachXBT warned of a large unauthorized withdrawal from several crypto exchange accounts a day earlier. He did not name the bank at first. He said the stolen money left as USDC and USDT, which are stablecoins, a type of cryptocurrency meant to hold a steady value.
The bank disclosed the incident on November 4. It said the situation "is now closed and under control" and that operations are slowly returning to normal. It also suspended certain systems in response.
According to the bank's FAQ page, the attacker reached its network through a service provider's platform. The attacker then used Arkéa's own account to send money to other banks and turn it into cryptocurrency. The bank ruled out human error and called it a "sophisticated attack." So the weak spot was not a careless bank employee.
The bank warned of a higher risk of phishing. That means fake emails, calls or texts built to trick you into handing over personal details. Customers should be wary of unsolicited messages and never share sensitive details by phone or email. If a message looks odd, call your bank adviser directly to check it.
The service provider has not been named in the material available. The exact origin of the attack and how it worked are still unclear. The bank is working with judicial authorities and the police to find out. ZachXBT said the lack of early public disclosure let the attacker launder $30 million by November 3, money that EU law enforcement could otherwise have frozen. BleepingComputer has asked the bank for more details and had not received a reply.
Even if your bank says your money is safe, treat any unexpected message about your account as suspect and call the bank yourself using a number you trust.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesA fake call in Truro, Canada, sent a police tactical team to a woman's home. An RCMP officer now shares plain rules for spotting phone scams.
Read more: Canadian police share simple rules to beat phone scammersKMBC 9 News has launched Scam School, a series on spotting the warning signs of scam texts and calls so you can protect your money and your family.
Read more: A local TV series shows the warning signs of phone and text scams
