Fortuneo hacked: €118 million diverted to cryptocurrency accounts
Crédit Mutuel Arkéa announced on Wednesday that it had suffered a cyberattack targeting its online banking platform. More than €118 million was diverted to cryptocurrency accounts opened under false identities.
Arkéa's cyberattack revealed
Crédit Mutuel Arkéa confirmed on Wednesday 4 November that it had been the victim of a cyberattack that enabled fraudulent transactions. According to Actu17, more than 133 million dollars (approximately €118 million) was diverted from Fortuneo, the online banking subsidiary of the group based in Relecq-Kerhuon (Finistère).
The group asserts that the incident is now contained and has no financial consequences for its customers. Upon detection, the teams temporarily suspended certain transactions to secure operations. The Banque de France was informed, and according to Le Figaro, the hackers targeted Fortuneo's own capital rather than depositors' money.
How the diversion worked
The fraudsters exploited a vulnerability to issue transfers from Fortuneo by entering the beneficiary's name themselves. The funds were then sent to accounts opened under false identities on cryptocurrency exchange platforms, notably Kraken.
These platforms were not hacked. The fraudsters created the accounts and then fed them with the fraudulent transfers, circumventing verification checks between the transfer sender and the account owner. Kraken confirmed that its security systems had not been compromised.
The path of the funds
Once on the exchange platforms, the fiat currency was converted into stablecoins and then withdrawn to external wallets. Initial withdrawals began on 1 November, with 12 million dollars transferred from OKX at 12:25 UTC, followed 44 minutes later by withdrawals from Kraken. Operations continued over several days.
According to sources cited by Actu17, American investigator ZachXBT, known for tracing funds on blockchains, initially reported a loss of 106 million dollars before raising his estimate to beyond 133 million upon discovering additional withdrawals.
Two hypotheses on the attack's origin
The exact origin of the vulnerability remains to be determined. A source within hacker circles puts forward two hypotheses: invisible compromise of the bank's payment systems over several days, or more likely an internal human error. The latter could correspond to a variant of the CEO fraud scheme mounted by a French-speaking network.
Kraken reportedly began freezing funds during the night of Monday to Tuesday. Faced with these blocks, the fraudulent network subsequently turned to other platforms to continue laundering the funds.
Public disclosure
The matter was revealed by ZachXBT via Telegram on Monday, before the name of the French bank was publicly confirmed between Tuesday and Wednesday. The blockchain specialist adjusted his estimates as new withdrawals were discovered. The amounts initially mentioned could, according to sources, be significantly higher than the €118 million confirmed.
Source: Actu17