Arkéa restarts transfers after $133M attack, crypto link stays unproven

Crédit Mutuel Arkéa is back in business. The French bank said almost all operations resumed on the morning of Nov. 4 after an attack that fired off fraudulent crypto transactions from its own account and jammed up some customer transfers. In a follow-up clarification, Arkéa said attackers got in through a service provider's platform, then sent money to other banks.

That money may have been converted into cryptocurrency through specialized platforms — but Arkéa isn't saying so. The bank didn't confirm the conversion and didn't tie its transfers to any specific crypto wallets. It also knocked down the idea that the breach came through Fortuneo, its online banking subsidiary, and said customer accounts were never touched. Arkéa called the incident contained and said customers' holdings were unaffected.

On the money, the bank is staying vague. Arkéa declined to confirm whether €118 million ($133 million) was stolen, validating only the order of magnitude. Some funds have been blocked and recovery efforts are ongoing, the bank said, which makes a definitive financial figure premature. It added that the sums won't threaten its financial strength. The bank says it's working with judicial and police authorities to pin down the attack's origin and method.

Then there's the other trail — a separate one. Blockchain analytics firm Bitquery reported tracing $108.8 million in USDC withdrawals from wallets it labels as belonging to Kraken, Crypto.com and OKX, landing in 15 addresses. The withdrawals ran from 12:25 UTC on Nov. 1 to 09:09 UTC the next day, roughly 21 hours. Bitquery says it can't see bank transfers or exchange accounts, so those withdrawals can't independently establish the route from Arkéa into crypto — or identify who owns the receiving accounts. Two of the 15 addresses connect to the suspected theft through intermediate wallets; drop those two and Bitquery's count falls to $95.7 million.

Bitquery also estimated on Nov. 4 that nearly $42.6 million remained on Ethereum in wallets it associated with the suspected theft, mostly in ETH. Its checks covered Ethereum in full, but it limited five other networks to exchange payments to the same 15 addresses.

So the picture is two lanes with a missing bridge. Arkéa's transfers are documented; the crypto withdrawals are traced; the connection between them is still a dotted line. The bank is running again, and investigators are still chasing where the money actually went.