Crédit Mutuel Arkéa’s chairman has put the bank’s loss from this month’s cyberattack at about €100 million and said the money was pushed out through instant payments using fake IBANs for its online bank Fortuneo before being moved onto crypto platforms. Julien Carmona gave the account in an interview with AFP published on Friday. It is the most detailed account so far from the French lender of the theft that blockchain investigator ZachXBT started tracking on crypto exchanges on Nov. 2.
What Arkéa’s chairman said
Carmona said the financial impact was close to “a hundred million euros,” equal to about 1% of the group’s equity or roughly one quarter’s earnings, and that the bank’s financial strength was not affected. He blamed a “very well organised, very well equipped” criminal group, called it “a new kind of heist” and said the attack was “very probably aided by advanced artificial intelligence.” He did not say what that AI role was, and he said the bank has had no claim of responsibility. (Quotes are translated from French.)
His timeline starts on Oct. 27, when Arkéa found signs that the information system of one of its service providers had been breached. The bank cut the link between its systems and the provider’s and reported the intrusion to authorities. At that point, Carmona said, nothing showed that material taken from the provider could later be used to get into Arkéa’s own systems. The provider has not been named.
Fake IBANs and instant payments
According to Carmona, fake Fortuneo IBANs were generated and used to trigger payment orders from Crédit Mutuel Arkéa’s own account through instant payment systems, which he said carry fewer checks than ordinary transfers by design. The payments started on Sunday, Nov. 1, and were dressed up to look legitimate. The money went to real accounts at other European banks that the fraudsters had opened themselves, which he said shows the attack was “prepared long in advance.” From there it went to crypto platforms to hide where it came from.
The bank says it grasped the scale of the attack on the morning of Tuesday, Nov. 3. It cut all external access to its systems and its connection to the interbank payment system, removed the fake accounts and reset authentication, then announced the incident on Wednesday, Nov. 4.
Arkéa’s earlier questions-and-answers page on the attack said the attackers used the bank’s own account rather than customer accounts, that no “entry” had been made through Fortuneo and that customers’ holdings were not affected. Carmona’s account fits with that: the IBANs were fake Fortuneo numbers, but the payment orders were drawn on Arkéa’s own account.
How the crypto trail lines up
The crypto side of the story surfaced before the bank spoke. On Nov. 2, ZachXBT said an unnamed EU entity was suspected of losing more than $106 million from multiple centralized exchange accounts the day before, with the funds withdrawn as USDC and USDT, as we reported at the time. He then raised the tally to more than $133 million, arguing that the lack of a proper incident disclosure had let more than $30 million be laundered that EU law enforcement could have frozen. On Nov. 4, he named Crédit Mutuel Arkéa as the alleged victim, said the attack ran over multiple days and suggested the true figure was larger once OTC activity was counted.
Carmona touched on the timing of those early alerts. He said crypto specialists had seen abnormal transactions heading to crypto platforms on the Sunday and Monday, “but at that moment, they themselves, and nobody to my knowledge, made the link with Crédit Mutuel Arkéa.”
The two numbers are not a like-for-like comparison. Asked in its Q&A whether €118 million, or $133 million, had been stolen, Arkéa said it would not confirm the figure and could “only validate the order of magnitude.” Carmona’s roughly €100 million is the bank’s own estimate, and Arkéa still has not published a final loss because it hopes to get some of the money back.
Frozen funds and what comes next
Carmona said that in a number of cases, banks and even crypto platforms delayed transactions and froze part of the funds as part of their own due diligence obligations. Some money has been recovered and talks over the rest are ongoing. The bank is also in discussions with its insurer, and Carmona said he is counting heavily on the police and judicial investigation because investigators have international cooperation tools the bank does not.
The Paris prosecutor’s office opened an investigation for organized intrusion into an automated data processing system and handed it to France’s anti-cybercrime office, Les Numériques reported.
The open questions are the final loss after recoveries, which provider was breached and whether investigators back up the AI claim. For exchanges, the case shows how quickly bank fraud paid out over instant euro rails can turn into stablecoin withdrawals, and how much depends on platforms spotting and freezing those flows in the first hours.
FAQ
How much did Crédit Mutuel Arkéa lose?
Chairman Julien Carmona put it at around €100 million, about 1% of the group’s equity. The bank has not given a final figure because some funds were frozen and recovery talks are continuing.
How did the money end up in crypto?
Carmona said fake Fortuneo IBANs were used to send instant payments from Arkéa’s own account to accounts the fraudsters had opened at other European banks, and the money then went to crypto platforms. ZachXBT tracked the related exchange withdrawals in USDC and USDT.
Were Arkéa or Fortuneo customers affected?
The bank says no. It said the attackers used its own account, not customer accounts, and that customer holdings were not affected.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
