The access path Arkéa has disclosed
Arkéa's initial notice said the incident had been contained and some transactions were temporarily suspended. In a later clarification, the bank said attackers entered through one of its service providers' platforms and reached Arkéa directly. The public statements do not name the provider or describe the technical entry method or duration of access. The bank characterized the attack as sophisticated and external, while inquiries into its origin continue.
The attackers used Arkéa's own account to send money to other banks. That is different from taking money directly from customer accounts. The bank says those transfers could then potentially have allowed conversion into cryptocurrency through specialized platforms. Its conditional wording matters: the statement does not verify particular exchange accounts, wallets or every subsequent transaction in that chain.
What customers experienced
According to Arkéa, holdings belonging to customers of its federations and subsidiaries were not affected. Fortuneo was not the point of entry, contrary to some early reports. Precautionary controls delayed the execution of some customer transfers, but nearly all operations resumed on the morning of November 4 after checks and stronger safeguards. These are the bank's reported operational findings, not the conclusion of an independent technical audit.
The first notice warned that phishing attempts could follow the incident. Arkéa subsequently explained that this was a precautionary warning, not an announcement that customer data had leaked. It urged customers to check suspicious messages with their bank adviser and never disclose credentials, card details or verification codes in response to an unsolicited request.
Why $133 million is not a confirmed final loss
Asked directly whether €118 million, or roughly $133 million, had been stolen, Arkéa declined to confirm the figure but acknowledged the order of magnitude. The final impact is still being measured: some funds have been blocked and recovery efforts continue. The bank says the sums involved do not threaten its financial health. Calling exactly $133 million a confirmed bank loss would therefore overstate what it has disclosed.
Before Arkéa's announcement, investigator ZachXBT estimated suspected withdrawals from centralized exchanges at more than $133 million. Separately, Bitquery traced $108.8 million in USDC moving from accounts at Kraken, Crypto.com and OKX to 15 Ethereum addresses on November 1 and 2. Those onchain transfers reveal token movements, not ownership of the originating bank account, the source of a fiat payment or Arkéa's net loss. Identifying the affected bank does not make these distinct figures interchangeable.
The remaining evidence gap
AFP reported that the Paris public prosecutor's office opened an investigation into an attack on an automated data-processing system allegedly carried out by an organized group. An investigation is not a finding on who conducted the attack. Arkéa says it has notified and is working with the relevant authorities and supervisors.
Further evidence would need to establish which vendor service was breached, the number and route of fraudulent bank transfers, how much was blocked, and whether those transfers connect to the observed crypto withdrawals. Until that chain is documented, three propositions should stay separate: the confirmed attack on Arkéa's own account, the bank's stated possibility of later crypto conversion, and independent estimates based on blockchain activity.
