At Kraken, an ordinary verified customer cannot deposit more than $100K a day, and withdrawal limits rise with the account's activity and age⁵. Nobody withdraws $9.6M from a brand-new account. An operation like this needs resources ready before Sunday.

That is why, in reality, the All Saints' heist starts long before, in the spring. Their accounts are prepared, fed with small sums, month after month, to push the limits up. In the jargon, warmed-up accounts. Going back through the history of each of the 18 recipient wallets, Zero Bullshit found the traces of the preparation: from May to the end of October, 12 of them take in 132 withdrawals from Kraken and Crypto.com, $2.34M in total. 5 of the 6 addresses behind Sunday's big withdrawals are funded from May, July, August or September. 3 other addresses, which are not among the 18 recipient wallets, also receive Kraken withdrawals, $1.1M in all, and pass part of it on to the future recipients.

These are the neighbouring addresses of the preparation. None of them appears in the lists published by ZachXBT, the independent investigator who broke the story. All of them pay the same recipients and sometimes pay each other. From afar, ordinary people buying a bit of crypto and moving it around. The same money may have gone round several times, but to withdraw up to $133K in one go, real funds are needed. In all, $2.34M goes through the recipient wallets during the warm-up, and the preparation ties up several hundred thousand dollars for months, for a loot that only arrives at the end. You have to know the exchanges' machinery inside out, and have the means to feed it.

2 other addresses in the same circuit take in 230 withdrawals from Kraken between June and September, $2.3M, as much as the recipient wallets during the whole warm-up: $843K for the first, $1.46M for the second. Their money goes on to relays that the recipient wallets' money also goes through, then they stop 4 days apart, on 10 and 14 September. During the theft, nothing moves. The blockchain does not say whether the accounts that fed them were used elsewhere, nor whether Kraken has closed them since. If they are still open, nothing stops them from being used again for another heist.

Graph 4 · Before the theft

Zero Bullshit noted the time of each one. These 132 withdrawals all happen between 7.12am and 9.43pm, Paris time, and only 11 on a Saturday or a Sunday. Office hours, lunch break included. This rhythm fits a time zone close to Paris, from London to Moscow, not Asia or the Americas, where it would fall in the middle of the night. None of this gives a name or a nationality: an account can be run from anywhere. What remains is a weekday schedule, kept from Europe or nearby, 107 of the 132 withdrawals from Monday to Thursday. As if well-organised office workers had run the heist of the century from an open-plan office with pale blue carpet.

On the night of the heist, no more schedule. On Sunday at 5.20pm, 3 accounts withdraw at the same time, each with its own style. During the night, between 1am and 7am, 2 accounts still chain 73 withdrawals in parallel, until Monday morning. The following night, nothing moves between 1am and 7am. Lights out. Several hands, teams taking turns and sleeping, or programs launched in advance: the blockchain cannot tell. Nothing, on the other hand, looks like the work of a lone hacker who stumbled on a flaw 2 days earlier while tinkering with Claude overnight.

Graph 5 · At what time

The accounts pass the identity checks required in Europe, known as KYC. Several sources close to the exchanges say that at least 2 of the identities used are fake, taken from recent data leaks. The crypto journalist Grégory Raymond also reports fake KYC⁶. There is no shortage of leaks: in September, Revolut admitted it had handed copies of customers' ID documents, and possibly verification selfies, to a third party posing as a government agency⁷. Kraken, for its part, says no account was hacked on its side⁸. In reality, these accounts do not need to be. Warmed up since the spring, they were not hijacked at the last minute: the fraudsters run them, even when they are opened in someone else's name, with a stolen identity. Their only job is to change euros into digital dollars, then get them out.

At the centre of this network, a wallet born at the end of December 2025 sees $6.9M stolen from Arkéa go through it. From January, it trades with an address that will pass on part of the stolen money to it on 1 November, and which has been dealing with another from the same network since autumn 2024. This circuit may belong to intermediaries, professionals who change any customer's crypto for a commission, rather than to the fraudsters themselves: its age does not necessarily date the preparation of the heist. Between May and August, this central wallet makes 2 small transfers that look like exit tests: 1.6K USDC to the neobank Revolut, then 1.35K USDC to Deblock, a French neobank that combines a euro account with crypto, through an address opened at Deblock on 5 August. Asked by Zero Bullshit, Deblock said it responds to requests from the authorities and never comments on the situation of an account or an address. The company only added that this address has not moved since 6 August. All the other platforms keep the same silence.

10 of the 18 recipient wallets run on the “smart account” of Trust Wallet, a mainstream app. An ordinary account signs its operations one by one and pays its own fees. The smart account can bundle several of them and have them executed, fees included, from another address. An outside address, active since August 2025 and with 11,500 transactions to its name, links the preparation and the theft. Between 31 August and 4 November, it sends enough to pay network fees, the small amounts of ether required for each transaction, to 38 wallets in the network, before and during the theft. The same fee payer, before and during the theft: the warm-up and the heist run on the same set-up.

The warm-up money, for its part, does not stay put. It moves from one address in the circuit to another, then goes out to KuCoin, to a Bybit deposit address, assigned to a specific customer of the exchange, or scatters: from 13 to 19 October, one of the circuit's addresses sends $694K in USDT, the other big digital dollar, to 37 different addresses. In October, the fee payer also funds the recipients of the warm-up, up to $348K for one of them. On 28 October, one of the future recipients sends 10.8K USDC to an address that a large USDT supplier, with more than 3,800 transactions on the clock, tops up the same day. That supplier pays in about $180K until 30 October, then more than $200K on 2 November, and that money joins the central wallet during the theft.

Graph 6 · Who funds whom

The calendar is no improvisation either. A standard SEPA transfer, the ordinary euro bank transfer, does not move on a Sunday: it takes instant payments, or orders sent earlier, perhaps as early as Friday. Their date has not been published. Choosing a Sunday public holiday is probably no accident: fewer people watching the accounts, and a whole night to convert before Monday morning. Nor is the choice of USDC. None of the withdrawals is in USDT, even though it is the most traded digital dollar in the world, issued by Tether. Since 2024 and 2025, to comply with MiCA, the EU's crypto-asset regulation, Kraken⁹, Crypto.com¹⁰ and OKX¹¹ no longer offer it to their European customers. European accounts funded in euros can hardly buy anything else.

The euros arrive by transfer from a bank: on the other side, you need accounts able to receive large euro transfers, which many offshore exchanges do not have. You also need depth, to change more than €100M in one evening without moving prices. And a transfer to Kraken looks like that of any customer buying crypto. Once KYC is passed, it is even regulation that opens up the high withdrawal limits. Choosing 3 regulated exchanges was no accident.

Who is pulling the strings, the blockchain does not say. The fee supplier may be a regular contractor or a laundering-on-demand service. An OTC desk, an intermediary that buys and sells large amounts of crypto directly between 2 parties, away from the exchanges, pays the network fees of one of the fraudsters' wallets, and one of the preparation addresses sends money to the same KuCoin deposit address as it does. This desk has been moving batches of $5M to $10M since April.

On Thursday 29 October, 3 days before the first withdrawal, Binance, the world's largest crypto exchange, is robbed of $6.34bn¹², the biggest theft in crypto history. The hackers got in through a developer: approached on LinkedIn by a fake recruiter, after 2 interviews he installed a “coding exercise” that contained spyware¹³. From his computer, they reached those of 2 engineers in charge of the wallets, then ran malicious code on the servers with stolen credentials¹⁴. The FBI attributes the attack to North Korea¹⁵. The way into Arkéa looks very much like the way into Binance: a compromised third party, with rights over transactions³. Nothing, however, establishes a link between the 2 cases, and ZachXBT rules out the North Korean lead for Arkéa¹⁶.

The next day, Friday 30 October, it is Chainalysis, the analytics firm that helps exchanges and police follow money on blockchains, that announces it has been hacked. An intruder used artificial intelligence agents to get into its systems during October, and took the names, email addresses and job titles of the users of its platform¹⁷, the investigators and compliance teams of its customers. Chainalysis says it found no link with the Binance theft, and nothing connects this leak to the Arkéa heist. Still, 2 days before the first withdrawal, the people who track dirty money saw their own directory go out into the wild.

In its statement², Arkéa describes:

“a sophisticated attack from outside”

Sophisticated, and above all prepared long in advance, since the spring at least. Accounts opened under false identities and warmed up for months, a shared toolkit, a fee supplier, a chosen date, a chosen currency. Not a flaw exploited in a hurry: a high-flying operation, built up over months.