Crédit Mutuel Arkéa Resumes Operations After $133 Million Fraud Attack, but Crypto Loss Remains Unconfirmed

French financial institution Crédit Mutuel Arkéa announced that nearly all operational services had been fully restored on November 4, following a sophisticated cyberattack that facilitated fraudulent cryptocurrency transactions through the bank’s proprietary accounts, which temporarily disrupted customer transfers.

In a subsequent statement, the bank clarified that the threat actors gained initial access via a third-party service provider’s platform, using it to initiate transfers to other financial institutions. These transactions were subsequently routed through specialized channels potentially designed for conversion into cryptocurrency.

Arkéa has yet to officially verify the actual conversion of these funds into digital assets or explicitly link its internal transfers to specific cryptocurrency wallets.

The institution explicitly denied that the breach occurred through Fortuneo, its online banking subsidiary, and confirmed that customer accounts were not utilized in the attack. Arkéa characterized the incident as fully contained, reassuring clients that their assets and holdings remain secure and unaffected.

While reports suggested a potential loss of €118 million (approximately $133 million), Arkéa declined to confirm the exact figure, validating only the general order of magnitude. The bank noted that a portion of the funds has already been successfully blocked, with ongoing recovery operations underway, rendering a definitive financial assessment premature.

The total volume of fraudulent transactions does not necessarily represent the bank’s final financial loss, as blocked funds and subsequent recoveries will be factored into the final tally. Arkéa asserted that the overall impact will not jeopardize its financial stability or operational integrity.

The bank’s initial communication outlined precautionary measures, including the temporary suspension of transactions and a phased, secure restart following comprehensive system checks and the deployment of enhanced security protocols. The latest update confirmed that virtually all services were successfully restored by morning.

Arkéa stated that it is actively collaborating with judicial and law enforcement authorities to thoroughly investigate the origin, methodology, and perpetrators behind the cyberattack.

Insights from the On-Chain Crypto Trail

In a parallel investigation, blockchain analytics firm Bitquery reported tracing approximately $108.8 million in USDC withdrawals. These funds were moved from wallets associated with major exchanges—Kraken, Crypto.com, and OKX—to 15 distinct addresses on November 1 and 2. The transactions occurred over a span of roughly 21 hours, starting at 12:25 UTC on November 1 and concluding at 09:09 UTC the following day.

Bitquery noted that its on-chain visibility is limited to blockchain data, meaning it cannot observe internal bank transfers or exchange account details. Consequently, the traced transactions alone cannot independently verify the alleged transfer path from Arkéa to cryptocurrency exchanges or identify the ultimate beneficial owners of the receiving accounts.

Arkéa’s Transfers and the Missing Crypto Connection

Arkéa’s official statements focus on unauthorized transfers from its proprietary accounts to traditional banking institutions, whereas Bitquery’s on-chain analysis tracks a distinct set of cryptocurrency withdrawals.

It is critical to note that the $108.80 million traced by Bitquery does not constitute a confirmed representation of the bank’s final loss.

• Reported Statement: Arkéa stated that cybercriminals exploited its proprietary accounts to transfer funds to other traditional banks, which may have subsequently allowed for conversion into cryptocurrency via specialized platforms (Arkéa’s November 4 clarification).
• On-Chain Investigation: Bitquery reported tracing $108.80 million in USDC withdrawals from wallets labeled as belonging to Kraken, Crypto.com, and OKX to 15 separate addresses on November 1 and 2 (Bitquery’s on-chain investigation).
• On-Chain Limitations: Bitquery emphasized that without visibility into traditional bank transfers or exchange internal ledgers, it cannot confirm the exact origin of the funds or control over the receiving accounts (Bitquery’s on-chain investigation).
• Reported Statement: When queried about reports of a €118 million ($133 million) theft, Arkéa declined to confirm specific amounts, validating only that the figures were in the general ballpark of the actual loss (Arkéa’s November 4 clarification).
• On-Chain Timeline: The tracked withdrawals occurred over a 21-hour window, specifically from 12:25 UTC on November 1 to 09:09 UTC on November 2 (Bitquery’s on-chain investigation).

To date, Arkéa has not confirmed the exact conversion of the funds into cryptocurrency, nor has an exact loss been finalized. Meanwhile, Bitquery’s tracing cannot definitively establish a direct link between the bank and the exchanges, nor verify the ownership of the destination wallets.

Note on Methodology: The provided schematic outlines the paths derived from Arkéa’s November 4 statement and Bitquery’s November 1–2 tracing. Solid arrows represent reported transaction flows, while the broken connector highlights the unconfirmed bridge between traditional banking transfers and cryptocurrency exchange conversions. No quantitative metrics or derived calculations are implied.

Of the 15 identified addresses, two are linked to the suspected theft via intermediate wallets. Excluding these two addresses from the analysis would reduce the tracked amount to $95.7 million.

As of November 4, Bitquery estimated that approximately $42.6 million remained on the Ethereum blockchain in wallets associated with the suspected theft, primarily comprising Ether (ETH).

While Bitquery conducted a comprehensive analysis of the Ethereum network, its investigation into five other blockchain networks was restricted to tracking exchange-related payments sent to the same 15 addresses.

Source link