French bank lost around €100 million in cyberattack "very likely" aided by AI

Attackers used a compromised service provider to gain access to Crédit Mutuel Arkéa's systems and transfer around €100 million (about $112 million) from the bank's account via instant payments. The bank's chairman calls it "a heist of a new kind" and says AI very likely helped, but he has not explained how exactly it came to pass.

Crédit Mutuel Arkéa, the Brittany-based banking and insurance group behind Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest and the online bank Fortuneo, disclosed the attack on November 4. In an interview with AFP published on November 12, chairman Julien Carmona described it as unprecedented "in terms of sophistication" and confirmed that the financial consequences come to "around a hundred million euros." He said that is roughly 1% of the group's equity, or the equivalent of one quarter's earnings, so the bank's solidity is "absolutely not affected." According to Reuters, the attack targeted the bank's account rather than its customers'.

How the attack unfolded

The breach started outside the bank. On October 27, Crédit Mutuel Arkéa found signs that a service provider's systems had been compromised, cut the connection between the two and notified the authorities. "But at that point, nothing allowed us to detect that elements had been taken from this third party in order to then enter our own information system," Carmona told AFP. The bank has not named the provider. Speaking to Les Echos, Carmona said this was a collective decision by the banks, since naming it could expose similar providers to attack.

Once inside, the attackers generated fake Fortuneo IBANs and used them to trigger payment orders from Crédit Mutuel Arkéa's own account to outside parties through instant payment systems, which Carmona said have "by definition, fewer controls than classic transfers." The transfers began on Sunday, November 1, with "everything done to circumvent controls, to make these illegitimate transfers look legitimate." The money went to real accounts at other legitimate European banks that the fraudsters had opened themselves, which Carmona took as a sign that the attack had been prepared long in advance. From there, it moved to crypto platforms to anonymize it.

The bank discovered the scale of the fraud on the morning of Tuesday, November 3. It cut all external access to its information system and its connection to the interbank payment system to stop further losses, removed the fake accounts and changed all authentication credentials before going public the next day. Carmona told Les Echos that Fortuneo's systems, and therefore its customers, were not affected.

A crypto trail spotted before the bank went public

Carmona acknowledged that crypto-asset specialists reported seeing abnormal transactions directed to crypto platforms on Sunday and Monday. "But at that point, they themselves, and no one to my knowledge, made the link with Crédit Mutuel Arkéa," he said.

At least one investigator made the link before the bank spoke. On-chain sleuth ZachXBT flagged more than $106 million in suspicious withdrawals on November 2, raised his estimate to more than $133 million and named Crédit Mutuel Arkéa on November 4, according to CoinDesk. Blockchain analytics firm Bitquery traced $108.8 million in USDC withdrawn from accounts at Kraken, Crypto.com and OKX over 21 hours on November 1 and 2, much of it converted into ether, which no central issuer can freeze. Crypto.com said it had blocked funds linked to the incident, and OKX said it had frozen an institutional customer account. ZachXBT said he had a "high degree of confidence" that North Korea's Lazarus Group was not behind it.

The bank has not published a final loss figure because it hopes to claw back some of the money. Carmona said banks and crypto platforms had been able to hold or freeze some transfers, that part of the funds had been recovered and that discussions over the rest were ongoing. The bank is also in talks with its insurer. Reuters reported that the Paris prosecutor's cybercrime unit opened an investigation after receiving the bank's complaint on November 4ю

Where did the AI component come in?

Carmona called the attackers "a very well organized, very well equipped, very well tooled criminal group" behind an attack "very likely aided by advanced artificial intelligence." No one has claimed responsibility, however, and he has offered no detail on what the AI supposedly did.

That matters, because the techniques disclosed so far are long-established and nothing new, even if AI is being blamed here. A compromised supplier, stolen access, fraudulent payment orders, mule accounts at other banks and crypto laundering do not require AI. AI could plausibly have helped with reconnaissance, coding, or forging of documents to open those accounts, but for now, the claim comes from a victim who refuses to provide evidence. The same goes for Carmona's self-stated belief that Crédit Mutuel Arkéa is the first French, and possibly European, bank to suffer a successful attack of this kind.