CryptoSlate
Crédit Mutuel Arkéa said almost all operations had resumed by Nov. 4 after attackers used a service provider's platform to send fraudulent transfers from the bank's own account. The bank declined to confirm reports of €118 million ($133 million) in losses, validating only their order of magnitude. It said some funds had been blocked and recovery efforts were underway.
Why it matters
The incident highlights the gap between a reported amount moved and a bank's eventual loss. Arkéa said customer accounts were not used, customer holdings were unaffected and the sums would not threaten its financial strength. It denied that attackers entered through its online banking subsidiary Fortuneo.
Arkéa said transfers to other banks may have enabled conversion into cryptocurrency, but it has not confirmed that conversion or linked its transfers to specific crypto wallets. Bitquery separately traced $108.8 million in USDC withdrawals from wallets it associated with Kraken, Crypto.com and OKX to 15 addresses on Nov. 1 and 2. The analytics firm said it cannot see bank transfers or exchange accounts, so its tracing does not establish a connection to Arkéa or identify the receiving accounts' owners.
Market impact
Bitquery said two of the 15 addresses connect to the suspected theft through intermediate wallets; excluding those two brings its traced amount to $95.7 million. It also estimated that nearly $42.6 million remained on Ethereum in wallets associated with the suspected theft, mostly in ETH. These are on-chain tracing figures, not a confirmed measure of Arkéa's loss.
Arkéa said it was working with judicial and police authorities to determine how the attack occurred. The bank initially suspended some transactions as a precaution, then gradually restarted them after checks and stronger security measures. The final loss and any link between the bank transfers and crypto withdrawals remain unconfirmed.
Frequently asked questions
-
Did Arkéa confirm that $133 million was stolen?
No. Arkéa declined to confirm the reported €118 million ($133 million) figure and validated only its order of magnitude. It said some funds had been blocked and recovery efforts were underway.
-
What did Bitquery trace in connection with the incident?
Bitquery traced $108.8 million in USDC withdrawals from wallets it associated with Kraken, Crypto.com and OKX to 15 addresses on Nov. 1 and 2.
-
Can Bitquery's tracing prove the withdrawals came from Arkéa?
No. Bitquery said it cannot see bank transfers or exchange accounts, so it cannot establish a connection to Arkéa or identify the owners of the receiving accounts.
-
What did Arkéa say about customer accounts and Fortuneo?
Arkéa said the attackers used the bank's own account, not customer accounts, and that customer holdings were unaffected. It denied that the attack entered through Fortuneo.
-
How much did Bitquery estimate remained on Ethereum?
Bitquery estimated that nearly $42.6 million remained on Ethereum in wallets it associated with the suspected theft, mostly in ETH. This is a tracing estimate, not a confirmed bank-loss figure.
WuBlockchain
TheBlock
Altcoin Daily
CoinDesk