Kraken sent 95% of the USDC traced in the Arkéa theft

The on-chain analytics firm Bitquery counts $126.04 million in USDC, the dollar stablecoin issued by Circle, that the main wallets of Kraken, Crypto.com and OKX paid on Nov. 1 and 2, 2026, to 17 addresses it ties to the theft at French bank Crédit Mutuel Arkéa. Kraken paid 95% of that count. If you trade on these exchanges or hold USDC or USDT, the question is who can stop such money once it leaves an exchange, and how much has been stopped.

The only freeze with a number came from Tether: $1.1 million in USDT tied to the thief, frozen at 11:10 p.m. UTC on Nov. 2. That is about 0.9% of the traced USDC. In an issuer freeze, the company behind a stablecoin blocks its own token at one address, much as a bank freezes an account. Circle had frozen none of the roughly 1.71 million USDC the thief still held at 8:47 a.m. UTC on Nov. 5.

Arkéa said in a follow-up release on Nov. 4 that it had been able to block part of the funds and that further recovery actions are underway. The bank gave no amount or location, and no exchange has disclosed a blocked amount. A figure from Kraken, Crypto.com, OKX or the bank would show how much more was stopped.

Kraken tells customers there is no ongoing risk

Kraken told Cointelegraph its security systems were not compromised, no customer accounts were taken over and there is no ongoing risk to its customers. A Crypto.com spokesperson told the outlet the exchange took “appropriate action to block any funds associated with this third-party incident” from moving through its platform. OKX said it was looking into the matter.

Arkéa says the money left as transfers first

Crédit Mutuel Arkéa announced in a press release on Nov. 4 that an attack had enabled fraudulent transactions. As the bank describes it, the attackers used Arkéa's own account to send transfers to other banks. Those transfers then potentially let them convert the money into crypto on specialized platforms. No customer accounts were used.

Each count covers a different slice

Bitquery's $126.04 million covers USDC that the three exchanges' main wallets paid to the 17 addresses. Four of those addresses link to the thief only through a few steps; without them, the total is $95.71 million. The count reads Ethereum in full, while the bank transfers, the exchange accounts and most activity on other chains lie outside it.

Kraken's last payouts came between 3:46 p.m. and 4:30 p.m. UTC on Nov. 2: $17.2 million to two more wallets in nine payments. The firm corrected its Nov. 4 update, which had put the end of the payouts that morning.

The firm's first reading was a break-in at the victim's own exchange accounts. Its current reading is that the wallet histories fit accounts set up in advance: if the bank's account holds, the exchange accounts and wallets belonged to the attackers from the start. The exchanges have not confirmed it.

Investigator ZachXBT's figure is higher. A Telegram post on Nov. 2 flagged a suspected loss of more than $106 million at an EU entity on Nov. 1, withdrawn as USDC and USDT from multiple centralized exchange accounts. A post edited Nov. 3 added more than $27 million in exchange withdrawals, for a lower bound of more than $133 million. Some of those withdrawals came after his first alert, he said on Nov. 4.

A post edited Nov. 4 named Crédit Mutuel Arkéa as the alleged institution. There, the investigator describes an attack that ran for several days and suspects a larger total once OTC activity is counted. OTC, or over-the-counter, trades are arranged directly between two parties instead of on an exchange's order book.

A Ledger Insights review, as cited by CryptoWatchDesk, counted $108 million in USDC, about $102 million of it from Kraken. That puts Kraken's share at about 94%, close to its 95% in the larger count.

Arkéa itself sticks to a rough scale. Asked whether 118 million euros ($133 million) had been stolen, the bank said it does not confirm the figure and can only validate the order of magnitude. Les Numériques and Bitquery report a provisional bank estimate of about 100 million euros, roughly $113 million at AFP's exchange rate.

$37.26 million is still held, mostly in ETH

Bitquery's Nov. 5 snapshot found $37.26 million still in Ethereum addresses tied to the thief, about 30% of the $126.04 million withdrawn from the exchanges. Most of it is ETH, valued at $2,421, its price at the snapshot, so the dollar amount moves with the market. Unlike USDT and USDC, ETH has no issuer that can freeze it at an address.

About $95.8 million had left those addresses by then, net of returns and valued at the same ETH price, mostly through bridges. A bridge is a service that moves tokens from Ethereum to another blockchain, much like a currency exchange at a border. The largest single route was LI.FI, a router that bridges and swaps tokens, at $36.09 million.

One transfer ran the other way: on Nov. 3, 396 ETH tied to the theft was deposited to a Kraken account.

As of Nov. 5, $37.26 million remained at the thief's addresses, including the $1.1 million in USDT that Tether froze, and about $95.8 million had moved on, mostly through bridges. The next figure to watch is the bank's definitive loss amount.