French bank resumes transfers after $133 million attack but leaves crypto loss unconfirmed

French bank Crédit Mutuel Arkéa said almost all operations had resumed on Nov. 4 after an attack enabled fraudulent crypto transactions from its own account, delaying some customer transfers.

In a later clarification, the bank said attackers reached it through a service provider's platform and sent money to other banks. Those transactions may then have enabled conversion into cryptocurrency through specialized platforms.

Arkéa did not confirm that conversion or connect its transfers to specific crypto wallets.

The bank denied that the attack entered through Fortuneo, its online banking subsidiary, and said it did not use customer accounts. It described the incident as contained and said customers' holdings were unaffected.

Arkéa declined to confirm whether €118 million ($133 million) had been stolen and validated only their order of magnitude. It said some funds had been blocked and further recovery efforts were underway, making a definitive financial amount premature.

The amount involved in fraudulent transactions is not necessarily the bank's final loss once blocked funds and recoveries are accounted for. Arkéa said the sums would not threaten its financial strength.

Its initial statement described precautionary transaction suspensions and a gradual restart after checks and stronger security measures. The later update said almost all operations had resumed during the morning.

Arkéa said it was working with judicial and police authorities to determine the attack's origin and method.

What the crypto trail can establish

Separately, blockchain analytics firm Bitquery reported tracing $108.8 million in USDC withdrawals from wallets it labels as belonging to Kraken, Crypto.com and OKX to 15 addresses on Nov. 1 and 2. The withdrawals ran from 12:25 UTC on Nov. 1 to 09:09 UTC the next day, roughly 21 hours.

Bitquery said it cannot see bank transfers or exchange accounts, so the transactions cannot independently establish the alleged route from Arkéa into crypto or identify the owners of the receiving accounts.

Two of the 15 addresses connect to the suspected theft through intermediate wallets, so excluding those two would reduce Bitquery's count to $95.7 million.

On Nov. 4, Bitquery estimated that nearly $42.6 million remained on Ethereum in wallets it associated with the suspected theft, mostly in ETH.

Bitquery examined Ethereum in full but limited its checks on five other networks to exchange payments to the same 15 addresses.