French bank resumes transfers after $133 million attack but leaves crypto loss unconfirmed
Arkéa says attackers used its own account through a provider's platform, while a separate $108.8 million USDC trail leaves the bank-to-crypto link unproven. Read the full story on CryptoSlateUnderstand the crypto stories that matter and what to watch next. Get The Catalyst in your inbox
French bank Crédit Mutuel Arkéa said almost all operations had resumed on Nov. 4 after an attack enabled fraudulent crypto transactions from its own account, delaying some customer transfers.
In a later clarification, the bank said attackers reached it through a service provider's platform and sent money to other banks. Those transactions may then have enabled conversion into cryptocurrency through specialized platforms.
Arkéa did not confirm that conversion or connect its transfers to specific crypto wallets.
The bank denied that the attack entered through Fortuneo, its online banking subsidiary, and said it did not use customer accounts. It described the incident as contained and said customers' holdings were unaffected.
Arkéa declined to confirm whether €118 million ($133 million) had been stolen and validated only their order of magnitude. It said some funds had been blocked and further recovery efforts were underway, making a definitive financial amount premature.
The amount involved in fraudulent transactions is not necessarily the bank's final loss once blocked funds and recoveries are accounted for. Arkéa said the sums would not threaten its financial strength.
Its initial statement described precautionary transaction suspensions and a gradual restart after checks and stronger security measures. The later update said almost all operations had resumed during the morning.
Arkéa said it was working with judicial and police authorities to determine the attack's origin and method.
Separately, blockchain analytics firm Bitquery reported tracing $108.8 million in USDC withdrawals from wallets it labels as belonging to Kraken, Crypto.com and OKX to 15 addresses on Nov. 1 and 2. The withdrawals ran from 12:25 UTC on Nov. 1 to 09:09 UTC the next day, roughly 21 hours.