French banking group Crédit Mutuel Arkéa said nearly all of its operations resumed on Wednesday following a cyberattack linked to a suspected theft from the bank's own account.

According to the group, services came back online after security checks and the implementation of additional safeguards. The bank said customer funds were unaffected and that the disruption only delayed certain transfers. The incident stands out for involving the bank's own funds rather than customer deposits, with portions of the money subsequently traced to withdrawals at major crypto exchanges.

Arkéa, one of France's major mutual banking groups, disclosed that the attackers gained access through a service provider rather than through Fortuneo, its online banking subsidiary. The intruders transferred the bank's money to other financial institutions, potentially allowing them to convert the funds into cryptocurrency. The disclosed entry point — a third-party provider rather than the bank's own online banking platform — highlights the security dependence of financial institutions on outside vendors.

The suspected theft first came to light through withdrawals from cryptocurrency exchanges. Blockchain analytics firm Bitquery traced withdrawals from accounts at Kraken, Crypto.com and OKX before the victim was publicly identified, meaning on-chain analysis surfaced the incident ahead of any official confirmation.

Pseudonymous on-chain investigator ZachXBT flagged more than $106 million in suspicious withdrawals on Monday, then raised his estimate above $133 million on Tuesday after uncovering another $27 million. His Wednesday report identified Arkéa as the potential victim.

The bank subsequently confirmed the attack and said it was still assessing its financial impact, leaving the exact loss figure open.

"We are not confirming these figures; we can only confirm the approximate scale," Arkéa said, according to a machine translation. The group published the statement on its official website.

Arkéa said some of the funds had been frozen and that further recovery efforts were underway. Kraken and Crypto.com previously told Cointelegraph that they had restricted accounts or blocked funds linked to the suspected theft. Both exchanges maintained that their platforms remained secure. With exchange-side freezes already in place and the bank's impact assessment ongoing, the amount ultimately recovered — and the final confirmed scale of the theft — are the key details to watch.

Originally reported by Cointelegraph: Crédit Mutuel Arkéa Resumes Operations After Cyberattack