Crédit Mutuel Arkéa resumes operations after attack, won't confirm €118M figure
In brief
- Arkéa said almost all operations resumed Nov. 4 after the attack delayed some customer transfers.
- Attackers reached Arkéa through a service provider's platform, not through Fortuneo, the bank said.
- Arkéa confirmed only the order of magnitude of €118 million ($133 million), not the figure itself.
- Bitquery traced $108.8 million in USDC to 15 addresses but can't link the funds to Arkéa.
What Arkéa has said
In a later clarification, Arkéa said attackers reached it through a service provider's platform and sent money to other banks. Those transfers may then have enabled conversion into cryptocurrency through specialized platforms. Arkéa didn't confirm that conversion, though (and it didn't connect its transfers to specific crypto wallets).
The bank denied that the attack entered through Fortuneo, its online banking subsidiary, and said it didn't use customer accounts. Arkéa described the incident as contained and said customers' holdings were unaffected.
Its initial statement described precautionary transaction suspensions and a gradual restart after checks and stronger security measures. Arkéa said it's working with judicial and police authorities to determine the attack's origin and method.
The €118 million question
Arkéa declined to confirm whether €118 million ($133 million) had been stolen. It validated only the order of magnitude.
Some funds have been blocked and further recovery efforts are underway, the bank said, so a definitive financial amount would be premature. That matters. The amount involved in fraudulent transactions isn't necessarily the bank's final loss once blocked funds and recoveries are counted. Arkéa said the sums wouldn't threaten its financial strength.
A separate USDC trail
Blockchain analytics firm Bitquery reported tracing $108.8 million in USDC withdrawals from wallets it labels as belonging to Kraken, Crypto.com and OKX to 15 addresses. The withdrawals ran from 12:25 UTC on Nov. 1 to 09:09 UTC on Nov. 2, roughly 21 hours.
The link to Arkéa is unproven.
Bitquery said it can't see bank transfers or exchange accounts, so the transactions can't independently establish the alleged route from Arkéa into crypto or identify who owns the receiving accounts. The $108.8 million isn't a confirmed bank-loss figure either. Two of the 15 addresses connect to the suspected theft only through intermediate wallets (excluding them would cut Bitquery's count to $95.7 million).
On Nov. 4, Bitquery estimated that nearly $42.6 million remained on Ethereum in wallets it associated with the suspected theft, mostly in ETH. Its coverage has limits. The firm examined Ethereum in full, but on five other networks it checked only exchange payments to the same 15 addresses.
Frequently asked questions
How much did Crédit Mutuel Arkéa lose in the attack?
Arkéa hasn't said. It declined to confirm whether €118 million ($133 million) was stolen and validated only the order of magnitude. The bank said some funds were blocked and recovery efforts were underway, so a definitive amount would be premature.
Is the $108.8 million USDC traced by Bitquery Arkéa's money?
That hasn't been established. Bitquery said it can't see bank transfers or exchange accounts, so its data can't confirm a route from Arkéa into crypto or identify who owns the receiving accounts. The $108.8 million isn't a confirmed bank-loss figure.
