French bank Crédit Mutuel Arkéa has resumed most of its operations after a cyberattack that led to fraudulent transfers totaling around $133 million. The bank confirmed that attackers exploited its own account through a service provider's platform, sending funds to other banks that may have later been converted into cryptocurrency. However, Arkéa has not confirmed the exact loss or the conversion into crypto assets.
In a statement, Arkéa clarified that the attack did not involve customer accounts and that the bank's financial stability remains intact. The bank is collaborating with authorities to investigate the incident's origin and method. Some funds have been blocked, and recovery efforts are ongoing, making the final loss figure uncertain.
Separately, blockchain analytics firm Bitquery traced $108.8 million in USDC withdrawals from wallets linked to exchanges like Kraken, Crypto.com, and OKX to 15 addresses over a 21-hour period. However, Bitquery cannot verify the connection between Arkéa's transfers and these crypto withdrawals, leaving the bank-to-exchange link unproven.
Arkéa emphasized that the reported loss figures are only estimates and that the actual financial impact may differ once recoveries and blocked funds are accounted for. The bank has implemented stronger security measures and is gradually restoring all operations.