The bank denied that the attack entered through Fortuneo, its online banking subsidiary, and said it did not use customer accounts. It described the incident as contained and said customers' holdings were unaffected.
Arkéa declined to confirm whether €118 million ($133 million) had been stolen and validated only their order of magnitude. It said some funds had been blocked and further recovery efforts were underway, making a definitive financial amount premature.
The amount involved in fraudulent transactions is not necessarily the bank's final loss once blocked funds and recoveries are accounted for. Arkéa said the sums would not threaten its financial strength.
Its initial statement described precautionary transaction suspensions and a gradual restart after checks and stronger security measures. The later update said almost all operations had resumed during the morning.
Arkéa said it was working with judicial and police authorities to determine the attack's origin and method.
What the crypto trail can establish
Separately, blockchain analytics firm Bitquery reported tracing $108.8 million in $USDC withdrawals from wallets it labels as belonging to Kraken, Crypto.com and OKX to 15 addresses on Nov. 1 and 2. The withdrawals ran from 12:25 UTC on Nov. 1 to 09:09 UTC the next day, roughly 21 hours.
Bitquery said it cannot see bank transfers or exchange accounts, so the transactions cannot independently establish the alleged route from Arkéa into crypto or identify the owners of the receiving accounts.
Arkéa's transfers and the missing crypto link
Arkéa describes own-account transfers; Bitquery follows a separate set of crypto withdrawals.
The $108.80 million traced by Bitquery is not a confirmed bank-loss figure.
- Reported statement. Arkéa said attackers used its own account to send transactions to other banks, potentially enabling conversion into crypto through specialized platforms. Arkéa's November 4 clarification
- Bitquery reported tracing $108.80 million in $USDC withdrawals from wallets it labels as Kraken, Crypto.com and OKX to 15 addresses on November 1 and 2. Bitquery's on-chain investigation
- Bitquery said it cannot see bank transfers or exchange accounts and therefore cannot confirm how the money was taken or who controlled the receiving accounts. Bitquery's on-chain investigation
- Reported statement. Asked whether €118 million ($133 million) had been stolen, Arkéa declined to confirm those figures and validated only their order of magnitude. Arkéa's November 4 clarification
- Bitquery's withdrawals span roughly 21 hours, from 12:25 UTC on November 1 to 09:09 UTC on November 2. Bitquery's on-chain investigation
Arkéa has not confirmed crypto conversion or an exact loss. Bitquery's tracing cannot establish the bank-to-exchange connection or ownership of the receiving accounts.
Method: Schematic paths from Arkéa's November 4 clarification and Bitquery's November 1–2 tracing. Solid arrows show reported transactions; the broken connector marks an unconfirmed bank-to-exchange connection. No quantitative geometry or derived arithmetic.
Two of the 15 addresses connect to the suspected theft through intermediate wallets, so excluding those two would reduce Bitquery's count to $95.7 million.
On Nov. 4, Bitquery estimated that nearly $42.6 million remained on Ethereum in wallets it associated with the suspected theft, mostly in ETH.
Bitquery examined Ethereum in full but limited its checks on five other networks to exchange payments to the same 15 addresses.
cryptoslate.com
