French bank resumes transfers after $133 million attack but leaves crypto loss unconfirmed
French bank Crédit Mutuel Arkéa said almost all operations had resumed on Nov. 4 after an attack enabled fraudulent crypto transactions from its own account, delaying some customer transfers.
Arkéa said attackers reached it through a service provider's platform and sent money to other banks. Those transactions may then have enabled conversion into cryptocurrency through specialized platforms.
The bank denied that the attack entered through Fortuneo, its online banking subsidiary, and said it did not use customer accounts. It described the incident as contained and said customers' holdings were unaffected.
Arkéa declined to confirm whether €118 million ($133 million) had been stolen and validated only their order of magnitude. It said some funds had been blocked and further recovery efforts were underway, making a definitive financial amount premature.
The amount involved in fraudulent transactions is not necessarily the bank's final loss once blocked funds and recoveries are accounted for. Arkéa said the sums would not threaten its financial strength.
Arkéa's initial statement described precautionary transaction suspensions and a gradual restart after checks and stronger security measures. The later update said almost all operations had resumed during the morning.
Arkéa said it was working with judicial and police authorities to determine the attack's origin and method.
Crypto trail traced by Bitquery
Separately, blockchain analytics firm Bitquery reported tracing $108.8 million in USDC withdrawals from wallets it labels as belonging to Kraken, Crypto.com and OKX to 15 addresses on Nov. 1 and 2.
The withdrawals ran from 12:25 UTC on Nov. 1 to 09:09 UTC the next day, roughly 21 hours.
Bitquery said it cannot see bank transfers or exchange accounts, so the transactions cannot independently establish the alleged route from Arkéa into crypto or identify the owners of the receiving accounts.
Bank-to-crypto link unproven
Bitquery said it cannot see bank transfers or exchange accounts and therefore cannot confirm how the money was taken or who controlled the receiving accounts.
Arkéa said attackers used its own account to send transactions to other banks, potentially enabling conversion into crypto through specialized platforms.
Arkéa has not confirmed crypto conversion or an exact loss. Bitquery's tracing cannot establish the bank-to-exchange connection or ownership of the receiving accounts.
Related
