Arkéa cyberattack: what the bank confirmed on crypto, and what not

Crédit Mutuel Arkéa said on Nov. 4 that attackers used the bank's own account to send transfers to other banks, which "potentially" let them convert the money into crypto on specialised platforms. AFP put the fraudulent transactions at around €100 million. The bank itself confirms an order of magnitude and nothing more precise.

Those facts come from sources of very different strength, so it helps to keep them apart.

What Arkéa's own statement says

In its Nov. 4 Q&A, the bank describes a sophisticated attack from outside that it says is now contained. The attackers did not touch customer accounts. They came in through the platform of a service provider, which the bank does not name, and not through its online arm Fortuneo, as some press reports had suggested. Clients lost nothing, and only some transfers were executed late.

The crypto link is worded with care. The bank says the transfers "potentially" allowed the conversion into cryptocurrency. AFP's summary is firmer and says the funds were converted, but that is not the wording of the bank's text.

On the amount, the bank was asked whether €118 million ($133 million) was taken. It does not confirm that figure and validates only the order of magnitude. It adds that part of the funds may have been blocked and that recovery steps are under way.

The Paris prosecutor's office told AFP it has opened an investigation into an "attack on an automated data processing system by an organised group". AFP's report names no suspect.

What ZachXBT, Bitquery and the press add

Outside the bank, the numbers come from blockchain tracing and one newspaper. AFP attributes the $133 million figure to Le Télégramme. Bitquery's write-up recounts that the on-chain investigator ZachXBT had flagged more than $106 million leaving exchange accounts by Monday, Nov. 2, and then raised his count to more than $133 million.

Bitquery, an analytics firm, counted $108.8 million in USDC withdrawn from accounts at three exchanges over 21 hours on Nov. 1 and 2, sent to 15 wallets. Its search covered Ethereum and the main wallets of those exchanges only, so the total is narrower than ZachXBT's. Bitquery also says the wallets do not look like a bank's own, and that it cannot see the bank transfers behind them.

Most of the USDC was swapped into ETH within hours, according to Bitquery. Unlike a stablecoin, ETH has no issuer that can freeze it, a gap that also shaped the Binance incident at the end of October.

Several basics are still open: the final amount, how the provider was breached, how much was blocked, and which platforms received the bank's transfers.

Recent cases such as Mercado Bitcoin's own security incident hit a crypto platform's hot wallets. Here, by the bank's account, the attackers started from a traditional bank's own account, and crypto would enter only at the cash-out.

In Bitquery's snapshot at 09:49 UTC on Nov. 4, $42.59 million still sat on Ethereum in addresses it ties to the theft, and Tether's freeze of $1.1 million in USDT was the only freeze it had recorded.