Crédit Mutuel Arkéa says hackers carried out fraudulent transactions

French cooperative bank Crédit Mutuel Arkéa has confirmed that hackers accessed its systems and carried out fraudulent transactions, although the bank says the incident has been contained and customers’ money is safe.

In a statement to customers on Wednesday, Arkéa said the attack was under control and that the security incident had been closed. They have not disclosed how the attackers gained access or how much money was taken.

The bank said it was still assessing the amount, but insisted the loss was not large enough to threaten the group’s financial position.

Estimates from outside the bank point to a much larger sum. Blockchain investigator ZachXBT first flagged suspicious withdrawals on 2 November and now estimates that more than $133m (around €118m) was stolen, mostly in stablecoins routed through cryptocurrency exchanges, French crypto publication Cryptoast reported.

ZachXBT said the final figure could be higher once over-the-counter transactions are included. He also said he was confident the attack was not carried out by North Korea’s Lazarus Group.

Arkéa temporarily suspended some transactions while investigating the breach. Those services are now being restored, although some transfers were delayed. The bank said it notified the authorities as soon as it detected the attack.

It has also warned customers to be alert to phishing attempts that may follow the incident. The bank advised them not to share passwords, card details or verification codes received by text message, and to contact their adviser if they receive suspicious requests.

The route the money took out of the bank remains unclear. French technology publication Presse-citron , citing journalist Grégory Raymond and an unnamed source, reported that the funds were withdrawn through Fortuneo, Arkéa’s online banking subsidiary, before being converted into cryptocurrency through accounts opened using false identities.

Blockchain analytics firm Bitquery separately tracked around $109m in USDC, a stablecoin pegged to the US dollar, leaving Kraken, Crypto.com and OKX between 1 and 2 November.

Some of the funds were converted into ether within hours before later moving through Monero, a cryptocurrency designed to make transactions difficult to trace.

Arkéa brings together Crédit Mutuel’s federations in Brittany and south-west France, alongside around 40 subsidiaries. The group has 5.8 million customers and €211.5bn in assets, and it is a significant French banking group, although considerably smaller than BNP Paribas and Société Générale.

The incident follows last week’s $6.3bn theft from Binance , the largest cryptocurrency heist on record. Elsewhere in Europe, businesses are also dealing with a wave of attacks targeting supermarket refrigeration systems .