Crédit Mutuel Arkéa resumes operations after $133 million cyberattack

Crédit Mutuel Arkéa stated that almost all operations had resumed on Nov. 4 following a cyberattack that enabled fraudulent cryptocurrency transactions from the bank’s own account. The incident caused delays in some customer transfers, but the bank described the situation as contained and confirmed that customer holdings were unaffected.

Bank clarifies attack vector

In a clarification issued on Nov. 4, the bank explained that attackers accessed its systems through a service provider’s platform. From there, they initiated transactions that sent money to other banks. Arkéa noted that these transfers may have subsequently enabled the conversion of funds into cryptocurrency through specialized platforms, though the bank did not confirm that conversion occurred or link its specific transfers to particular crypto wallets.

The bank explicitly denied that the attack entered through Fortuneo, its online banking subsidiary. It also stated that customer accounts were not used in the incident. Arkéa described its initial response as involving precautionary suspensions of transactions, followed by a gradual restart after security checks and the implementation of stronger measures. By the morning of Nov. 4, the bank reported that nearly all operations were back online.

Financial impact and on-chain tracing

Arkéa declined to confirm whether €118 million ($133 million) had been stolen, validating only the order of magnitude of the reported figures. The bank stated that some funds had been blocked and that further recovery efforts were underway, making it premature to declare a definitive financial loss. It added that the sums involved would not threaten its financial strength. The bank is currently working with judicial and police authorities to determine the origin and method of the attack.

Separately, blockchain analytics firm Bitquery reported tracing $108.8 million in USDC withdrawals from wallets it labels as belonging to Kraken, Crypto.com, and OKX. These withdrawals were sent to 15 addresses between 12:25 UTC on Nov. 1 and 09:09 UTC on Nov. 2, a window of roughly 21 hours. Bitquery noted that two of these addresses connect to the suspected theft through intermediate wallets; excluding them reduces the traced amount to $95.7 million.

Bitquery emphasized that it cannot view bank transfers or exchange accounts, meaning it cannot independently establish the route from Arkéa into the cryptocurrency ecosystem or identify the owners of the receiving accounts. As of Nov. 4, the firm estimated that nearly $42.6 million remained on the Ethereum network in wallets associated with the suspected theft, mostly in the form of ETH. The firm examined the Ethereum network in full but limited its checks on five other networks to exchange payments directed to the same 15 addresses.