Analysis: French online bank Fortuneo's fraud losses may far exceed $133 million, with funds laundered through crypto channels
November 4 - Crypto journalist Grégory Raymond posted that French mutual credit group Crédit Mutuel Arkéa's online bank Fortuneo suffered a fraudulent cyber attack on November 1. Combining new sources and on-chain analysis, the fund path can be gradually reconstructed, and the on-chain visible scale may be far more than the previously disclosed approximately $133 million. The fraudsters were able to initiate transfers from Fortuneo and set the recipient names themselves, equivalent to being able to send payments to any account globally under self-chosen names. Sources close to the hacker community lean more toward an internal human vulnerability rather than a long-term latent intrusion into the payment system. Analysis suggests this attack may be a variant of "CEO fraud" carried out by French-speaking cyber actors, i.e., impersonating executives to induce employees to cooperate.
Raymond stated that during the same period, someone used forged identities sufficient to pass KYC to open accounts on trading platforms such as Kraken. Fortuneo transfers were made in the real name of that account, not through theft of the bank's account on the platform. After fiat currency arrived, it was converted into stablecoins and then withdrawn. Bitquery tracked withdrawals from Kraken and Crypto.com, with the earliest outflow at 12:25 UTC on November 1, and about 44 minutes later a simultaneous withdrawal appeared on Kraken.
On-chain detective ZachXBT initially estimated over $106 million in USDC and USDT withdrawals, later raising it to over $133 million. During the night of November 1 to 2, approximately $63 million in stablecoins was swapped via Uniswap into 27,553 ETH, then partially converted into Monero through instant exchange and cross-chain channels. Currently, Crédit Mutuel Arkéa has not officially announced the incident. Non-on-chain cash-outs and over-the-counter trading may mean the total loss is higher.