French bank resumes transfers after $133 million attack but leaves crypto loss unconfirmed
Quick Take
- Arkéa says almost all operations resumed after an attack through a provider's platform enabled fraudulent transfers from its own account.
- The bank validated only the order of magnitude of reported loss figures, with some funds blocked and recoveries underway.
- Bitquery traced $108.8 million in USDC withdrawals but cannot verify the bank-to-exchange link or the bank's final loss.
French bank Crédit Mutuel Arkéa said almost all operations had resumed on Nov. 4 after an attack enabled fraudulent crypto transactions from its own account, delaying some customer transfers.
In a later clarification, the bank said attackers reached it through a service provider's platform and sent money to other banks. Those transactions may then have enabled conversion into cryptocurrency through specialized platforms.
Arkéa did not confirm that conversion or connect its transfers to specific crypto wallets.
The bank denied that the attack entered through Fortuneo, its online banking subsidiary, and said it did not use customer accounts. It described the incident as contained and said customers' holdings were unaffected.
Arkéa declined to confirm whether €118 million ($133 million) had been stolen and validated only their order of magnitude. It said some funds had been blocked and further recovery efforts were underway, making a definitive financial amount premature.
The amount involved in fraudulent transactions is not necessarily the bank's final loss once blocked funds and recoveries are accounted for. Arkéa said the sums would not threaten its financial strength.
Its initial statement described precautionary transaction suspensions and a gradual restart after checks and stronger security measures. The later update said almost all operations had resumed during the morning.
Arkéa said it was working with judicial and police authorities to determine the attack's origin and method.
What the crypto trail can establish
Separately, blockchain analytics firm Bitquery reported tracing $108.8 million in USDC withdrawals from wallets it labels as belonging to Kraken, Crypto.com and OKX to 15 addresses on Nov. 1 and 2. The withdrawals ran from 12:25 UTC on Nov. 1 to 09:09 UTC the next day, roughly 21 hours.
Bitquery said it cannot see bank transfers or exchange accounts, so the transactions cannot independently establish the alleged route from Arkéa into crypto or identify the owners of the receiving accounts.
Arkéa's transfers and the missing crypto link
Arkéa describes own-account transfers; Bitquery follows a separate set of crypto withdrawals.
The $108.80 million traced by Bitquery is not a confirmed bank-loss figure.
- Reported statement. Arkéa said attackers used its own account to send transactions to other banks, potentially enabling conversion into crypto through specialized platforms. Arkéa's November 4 clarification
- Bitquery reported tracing $108.80 million in USDC withdrawals from wallets it labels as Kraken, Crypto.com and OKX to 15 addresses on November 1 and 2. Bitquery's on-chain investigation
- Bitquery said it cannot see bank transfers or exchange accounts and therefore cannot confirm how the money was taken or who controlled the receiving accounts. Bitquery's on-chain investigation
- Reported statement. Asked whether €118 million ($133 million) had been stolen, Arkéa declined to confirm those figures and validated only their order of magnitude. Arkéa's November 4 clarification
- Bitquery's withdrawals span roughly 21 hours, from 12:25 UTC on November 1 to 09:09 UTC on November 2. Bitquery's on-chain investigation
Arkéa has not confirmed crypto conversion or an exact loss. Bitquery's tracing cannot establish the bank-to-exchange connection or ownership of the receiving accounts.
Method: Schematic paths from Arkéa's November 4 clarification and Bitquery's November 1–2 tracing. Solid arrows show reported transactions; the broken connector marks an unconfirmed bank-to-exchange connection. No quantitative geometry or derived arithmetic.
Two of the 15 addresses connect to the suspected theft through intermediate wallets, so excluding those two would reduce Bitquery's count to $95.7 million.
On Nov. 4, Bitquery estimated that nearly $42.6 million remained on Ethereum in wallets it associated with the suspected theft, mostly in ETH.
Bitquery examined Ethereum in full but limited its checks on five other networks to exchange payments to the same 15 addresses.
Mentioned in this article
Editorial credits
Gino Matos is a law school graduate and a seasoned journalist with six years of experience in the crypto industry. His expertise primarily focuses on the Brazilian blockchain…