Arkéa Restarts Transfers After $133M Attack. The $108.8M USDC Trail Still Belongs to No One

Arkéa's payment rails are back online. The French bank has resumed outgoing transfers after attackers took roughly $133 million, and the detail that matters more than the headline number is this: the intruders didn't crack its core systems. They logged into Arkéa's own account through a third-party provider's platform.

That's a vendor problem dressed up as a cyberattack. Somebody on the provider side held access to the front door, and the bank's own credentials did the rest. Frankly, that's the scarier version. Firewalls get tested constantly. Vendor access doesn't get tested nearly enough.

Then there's the other half. About $108.8 million in USDC has been traced along a route that hasn't been publicly tied to Arkéa. The bank hasn't confirmed a crypto loss at all. So you've got nine figures of reported damage on one side and a nine-figure stablecoin trail on the other, with no proven bridge between them.

From a risk perspective, that gap is the story. Stablecoin flows that size don't move quietly. Whoever pushed that USDC needed exchange access, off-ramps, and a way to break the trail behind them. If that money came off Arkéa's rails, the bank is staring at a much uglier number than $133 million. If it didn't, then someone else took a hit and hasn't said so yet.

Worth remembering how these disclosures usually go. Banks report fiat losses because regulators make them. Crypto exposure gets described as under review for as long as the lawyers allow, because confirming it means marking it on the balance sheet. The numbers tell the story. So does the silence.

My take: the interesting shift here isn't the size of the attack. It's that a French bank with real retail deposits got hit sideways through a provider, which means every institution renting crypto infrastructure is carrying exposure it can't see on its own dashboards. Vendor diligence is the new attack surface, and most banks still treat it as a procurement checkbox.

Watch the on-chain trail. If those addresses touch a KYC'd exchange with funding traceable to Arkéa, conviction flips fast and this stops being a two-part story.