The Arkéa theft left a trail in Kraken's euro market

Crédit Mutuel Arkéa said on Wednesday that attackers used the French bank’s own account to send money to other banks, “which then potentially allowed them to convert this money into cryptocurrency via specialized platforms”.Crédit Mutuel Arkéa confirms $133m theft, funds laundered via crypto exchanges (updated) - Ledger Insights -…. It described a “sophisticated attack from outside” and said no client accounts were involved. It would not confirm the reported $133 million, saying only that it could “validate the order of magnitude”.

Public market data points the same way. On 1 November, as money left Kraken, the exchange’s USDC/EUR market had its two busiest hours of the previous 30 days.Kraken public hourly market data, 30 days to 3 November. Nine withdrawals, $63.2 million in total, each came within four minutes of a USDC purchase of the same size on that market.Kraken public trades matched to withdrawals, S-Curve analysis. Public trades carry no account names, so the link rests on size and timing.

From euros to USDC

A normal hour on Kraken’s USDC/EUR market trades about €3.9 million. Between 21:00 and 22:00 UTC on 1 November it traded €47.1 million, after €37.1 million the hour before. Over 30 hours, volume on the market tracked withdrawals with a correlation of 0.87. Sterling and Swiss franc USDC markets showed nothing of comparable size.

The nine matches are tight. At 20:06:06 UTC, 9,827,294 USDC was bought for euros, and at 20:08:11 UTC $9,806,638.62 was withdrawn to one of the addresses. Together the nine purchases took 63.3 million USDC for about €57.7 million. Run on rescaled amounts, or on times shifted by up to four hours, the same test found zero or one match instead of nine.Placebo runs of the Kraken match, S-Curve analysis.

The buying moved the price. USDC reached €0.9491 on Kraken at about 22:03 UTC, roughly 5.9% above the €0.8965 of earlier that day. OKX reached about €0.9058 and Bitstamp about €0.9008 in the same hours, so the pressure was concentrated on one venue.Public hourly USDC/EUR market data from OKX and Bitstamp.

What the exchanges and the bank say

Kraken says the money did not start with it. “This incident did not originate on the Kraken platform, and we’re actively investigating reports that some of the assets were subsequently moved through accounts on our platform,” the exchange told Cointelegraph.Kraken Restricts Accounts Amid Suspected $133M EU Crypto Theft. It added: “We’ve restricted the accounts in question and are working with law enforcement to support recovery efforts.” Crypto.com said it had “taken appropriate action to block any funds associated with this third-party incident from moving through Crypto.com”. OKX told Cointelegraph it was looking into the matter.

The incident became public through the investigator ZachXBT, who posted on Monday that an EU entity was suspected of losing $106M+ from exchange accounts.ZachXBT Telegram 372: community alert, EU entity suspected of losing $106M+. He later raised the total to $133M+,ZachXBT Telegram 374: update, total $133M+, working theory. and at 02:24 UTC on 4 November wrote that the institution “is allegedly Credit Mutuel Arkea”.ZachXBT Telegram 375: update 2, names the institution. Arkéa issued statements at 13:00 and 17:30 French time that day, saying that the amounts do not threaten its financial health and that it is too early for a final figure.Crédit Mutuel Arkéa press release, 4 November 2026 17:30: further information on the attack. The bank has total assets of 211.5 billion euros.French bank Crédit Mutuel Arkéa exploited for over $133 million, ZachXBT says | The Block. The attackers reached it through the platform of a service provider, it said, and not through its online bank Fortuneo. The Paris prosecutor’s office said it had received the bank’s complaint and opened an investigation.Le Crédit Mutuel Arkéa victime d’un piratage de plus de 100 millions d’euros sans répercussion pour les clients: ….

The wallets were already there

The addresses that took the money were not new. Ten of the 15 that ZachXBT published had been receiving withdrawals from the same three exchange wallets since 14 May: 100 withdrawals worth $1.53 million.Withdrawals from Kraken, Crypto.com and OKX to the published addresses: Blockscout token transfers, S-Curve analysis. Of those, 93 fell on weekdays and 77 landed before 13:00 UTC. Eight of the 15 run a smart-wallet contract whose source returns the version string TrustWallet.Biz.v1.0.0.Blockscout address records for the published addresses and exchange wallets. The analytics firm Bitquery reads the setup as that of “a trading or payments business using ordinary crypto wallets,” according to Crypto News Flash.$133M Crypto Theft May Have Hit a European Bank - Crypto News Flash.

Those wallets did not hold money for long. Before the theft they passed it on to other wallets, and from there to exchange deposit addresses and swap services.Blockscout stablecoin flows from the published addresses before 1 November, S-Curve analysis. On the day, $108.6 million went to 29 next-hop wallets, and only one of those had been used before. That one got $5,276.87 from theft address 0x795a9d22 at 17:38 UTC on 1 November, emptying the address to its usual counterparty. Four hours later 0x795a9d22 passed $9.6 million to a new wallet.

That history belongs to whoever ran the wallets, and it points away from a bank’s treasury. It does not say who they were, or what they knew about the money.

Out through Ethereum

Counting only real USDC and USDT on Ethereum, 101 withdrawals reached the 15 addresses between 12:25 UTC on 1 November and 16:30 UTC on 2 November, a total of $108.6 million. Kraken supplied 94.5% of it, Crypto.com $5.4 million and OKX $0.6 million, and the rest of ZachXBT’s total is not in these flows. Four addresses first received exactly $1,000 and then, within five minutes, $1 million or more.

ZachXBT described the actor “aggressively swapping USDC for ETH”, and the ledger shows it. One wallet took in $60.72 million of USDC and sent out 27,699 ETH, worth about $63 million at Tuesday evening’s price.Blockscout token transfers of wallet 0x9EcA05D7; Blockscout balances and transactions of the wallets receiving ether, 3 November. By then there was little left for issuers to freeze: the 15 addresses held 872 USDC and 2,368 USDT, and only one of 19 large next-hop wallets still held a material balance, 1,314,666 USDC.Blockscout balances of the published addresses and their next-hop wallets, 3 November. Cointelegraph, citing Bitquery, reported that Tether had frozen $1.1 million of USDT. Arkéa says part of the funds has been blocked. ZachXBT said with “a high degree of confidence” that the actor is not Lazarus Group.

What is still open

Arkéa has not named the other banks or the platforms. The first withdrawal came on a Sunday, and the bank has not said when the transfers left its account; ZachXBT says the attack ran “for multiple days” and suspects the total is larger once over-the-counter deals are counted. The next fact sits with the holders of the accounts Kraken says it has restricted, and with the Paris investigators.