[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-credit-mutuel-arkea-admits-attack-wont-confirm-133m-loss":10,"sections":46},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":35,"tags":36,"sources":41,"feedback":45,"feedback_at":22,"cost_usd":45,"total_tokens":45},12617,"credit-mutuel-arkea-admits-attack-wont-confirm-133m-loss","Crédit Mutuel Arkéa Admits Attack, Won't Confirm $133M Loss","The French bank confirmed an attack that came through a service provider, but would only endorse the order of magnitude of an analyst's $133 million estimate.","Crédit Mutuel Arkéa has confirmed a cyberattack that reached its own money, but it has not confirmed how much was taken.\n\nThe figure comes from ZachXBT, a blockchain fraud investigator. On November 2, he flagged an unnamed EU entity that had lost $106M+ the day before from multiple centralized exchange accounts, withdrawn as USDC and USDT (stablecoins, tokens pegged to the US dollar). A day later he raised the total to $133M+. He wrote that the thief was \"aggressively swapping\" USDC for ETH, routing funds through instant exchanges, converting some into Monero (a privacy-focused token that is hard to trace), and bridging across chains. He never named the bank.\n\nThe bank spoke on November 4. It said it had detected an attack, suspended certain transactions as a precaution, and contained it. A day later, an FAQ said the attackers went through a service provider's platform and reached Arkéa directly, then used the bank's own account to transact with other banks. It would not name the provider, though it ruled out Fortuneo. Asked about the $133 million figure, it said it could \"simply validate the order of magnitude.\"\n\nThe bank's framing and the analyst's numbers sit awkwardly together. Customers were unaffected, the bank said, and the incident \"only led to a delayed execution of certain transfer operations.\" That can be true for depositors and still leave a nine-figure hole on the bank's own books.\n\nThe timeline also stands out. The theft surfaced on public blockchains, where an outside analyst could see it, before the bank said anything. ZachXBT argued that the lack of disclosure let $30M+ be laundered that EU law enforcement might have frozen. That is his view, and the bank's statements do not address it.\n\nNo group has claimed the attack, and ZachXBT does not think North Korea's Lazarus Group was behind it. The open question is which provider's platform gave attackers a path to a bank account.","[\"cyberattack\",\"banking\",\"cryptocurrency\",\"third-party-risk\"]","2026-11-09T14:45:00.000Z","2026-11-09T15:29:54.808Z","2026-11-09T15:29:55.120Z","published",null,[24,30],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Remove the leftover editing-note language in the fourth paragraph (\"the source does not reconcile them\"), and either state the tension between the bank's \"delayed execution of transfers\" and ZachXBT's exchange-account withdrawals as the writer's own analysis or cut it; also soften the unsupported closing speculation about what naming the service provider \"may say.\"","resolved",{"id":31,"reviewer":32,"round":33,"reason":34,"status":29},"publisher-r2","publisher",2,"The lede says the bank 'confirmed' the roughly $133 million theft, but the body says it would not confirm the amount and only validated the 'order of magnitude', so the headline and lede overstate what the bank confirmed.","security",[37,38,39,40],"cyberattack","banking","cryptocurrency","third-party-risk",[42],{"name":43,"url":44},"TechRadar","https:\u002F\u002Fwww.techradar.com\u002Fpro\u002Fsecurity\u002Ffrench-bank-credit-mutuel-arkea-hit-in-cyberattack-up-to-usd133-million-stolen-and-systems-shut-down",0,{"sections":47},[48,53,57,62,67,72,77,82,87,92,97,102,107,112],{"name":49,"slug":50,"count":51,"latest_published_at":52},"AI","ai",7144,"2026-11-12T13:27:45.000Z",{"name":54,"slug":35,"count":55,"latest_published_at":56},"Security",1128,"2026-11-11T18:05:00.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Deals","deals",642,"2026-11-12T14:00:00.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Policy","policy",619,"2026-11-12T12:53:36.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Consumer Tech","consumer-tech",364,"2026-11-12T11:12:32.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Hardware","hardware",336,"2026-11-12T11:24:43.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Science","science",230,"2026-11-12T10:00:00.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Software","software",168,"2026-11-11T17:36:49.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Startups","startups",159,"2026-11-11T12:30:00.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"Dev Tools","dev-tools",127,"2026-11-11T19:00:44.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"General","general",118,"2026-11-11T16:49:42.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Gaming","gaming",107,"2026-11-12T10:09:03.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":113,"slug":114,"count":115,"latest_published_at":116},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]