Once the money is out of the exchanges, a 2nd race begins. On one side, the fraudsters, who have to change their digital dollars into something nobody can freeze. On the other, those who can still stop them: the exchanges, which can block a customer's account, and the issuers, Circle and Tether, which can block the tokens of an address with a click, wherever it is. Provided someone flags the addresses to them: the victim, its bank, an exchange or the authorities. And quickly, before the money changes form. Zero Bullshit matched, hour by hour, the movements of the money, the public alerts and the freezes, from Sunday evening to Thursday morning. Some decisive times remain unknown, starting with the time the bank spotted the fraud. The fraudsters run the race hour by hour. The first freeze visible on the blockchain only comes overnight from Monday to Tuesday.

From 3.54pm on Sunday, even before the big withdrawals, a first route opens, which Zero Bullshit reconstructed address by address. Wallets in the network send their USDC to Arbitrum, a side blockchain of Ethereum through which deposits to Hyperliquid, a decentralised exchange, pass. There, the money goes to buy XMR1, a token issued by Wagyu.xyz that represents Monero, the cryptocurrency designed so that nobody can trace payments. The purchases go through in small orders, a few dozen dollars at a time. Wagyu promises to deliver real Monero within minutes, without identity checks¹⁸. The same route, through Arbitrum, Hyperliquid and Monero, was used to prepare the THORChain theft in May, according to Chainalysis¹⁹, and in October ZachXBT showed that more than 87% of the money that went through a competing service came from illicit activity²⁰.

In the evening, out of the exchanges, half of the money moves on in less than 72 seconds, through 508 wallets, 442 of which had no activity before 1 November. Each of the 15 recipient wallets served on Sunday splits its share between several exits. Part is changed into ether. Another part takes bridges, which move it onto another blockchain. Another goes through instant exchanges, sites that convert one crypto into another in a few minutes, without opening an account. The rest is deposited on exchanges. The same pattern for every recipient wallet, within minutes. Nothing improvised: the recipe is written in advance, and applied to the letter. It uses every laundering technique that a whole part of the crypto ecosystem makes possible.

Between 1am and 5am, overnight from Sunday to Monday, $63M is changed into ether. Once in ether, nobody can freeze it any more. The window to block most of it closes before offices open. And the sums still within reach shrink by the hour.

Graph 7 · The freeze window

On Monday at 1.28pm, ZachXBT publishes 11 addresses from the theft on Telegram, with a first figure: $106M¹⁶. Anyone can now follow the money. 3 hours later, Kraken still lets $17.2M out, more than 27 hours after the first withdrawal, to 2 new wallets, $8.73M for one and $8.52M for the other, in 45 minutes. The exchange has not said when it was alerted. With the 15 from Sunday, that makes 17 recipient wallets. Zero Bullshit found the 18th, fed with small withdrawals until 3 November. It and 2 other recipient wallets, including one of the big $9.6M withdrawals, appear neither in ZachXBT's first list¹⁶ nor in his second²¹. These 3 recipient wallets are not the 3 neighbouring addresses of the preparation: Zero Bullshit widens the known network on both sides.

Overnight from Monday to Tuesday, Tether freezes $1.14M of USDT, 35 hours after the first withdrawal. It is the first freeze. Their wallets then still hold about $16M that could be frozen, and will not be. Circle freezes nothing. Yet the issuers know how to move fast: on the evening of the Binance theft, Tether froze more than $1.567bn in USDT, according to its CEO Paolo Ardoino, and Circle more than $800M in USDC²².

Part of the money nonetheless comes back within reach of a freeze. Over the following days, the fraudsters bring about $40M in USDT onto Tron, the blockchain of USDT, where a transfer costs a few cents and where most resales of digital dollars for cash are negotiated. More than half of illicit crypto flows in 2024 went through it, according to the analytics firm TRM Labs²³. $9M arrives there through Rango and through Bridgers, the bridge built into the Trust Wallet and SafePal apps. On Tron, USDT remains freezable by Tether.

Graph 8 · Where it went

On Tuesday 3 November, Kraken raises the alarm, after receiving unusually large transfers from a European bank, and blocks the transactions under way³. That is 2 days after the first withdrawal, and the day after Monday's $17.2M. The exchange says it has restricted the accounts involved and is working with law enforcement⁸. The same day, ZachXBT raises his count to $133M and accuses the bank: for lack of a proper report, more than $30M that European police could have frozen has been laundered²¹. According to a source within the ACPR, the French banking supervisor, Arkéa did alert its supervisor, before the case became public, without being able to give the details.

On Wednesday 4 November, the story breaks in France. More than €100M of cryptocurrency stolen from Fortuneo: for 2 days, that is the version doing the rounds. Franceinfo, the French public broadcaster's news service, reports a hack of more than €100M, turned into cryptocurrency to get out of the bank²⁴. Grégory Raymond points to transfers from Fortuneo to the Kraken accounts⁶. And according to L'Agefi, a French financial newspaper, quoted by Decrypt, the bank applied in May for a licence to offer crypto to its customers²⁵. The confusion comes naturally. At 1pm, the Breton cooperative banking group acknowledges an “attack” that enabled “fraudulent transactions”²⁶.

The fraudsters, meanwhile, are still offloading the loot. In the afternoon, about 740 ETH is changed into USDT and sent to Tron. From noon, a Tron address created on 3 November pools USDT and sends out 300K roughly every 15 minutes, $4.5M in 4 hours. An intermediary takes 0.15% along the way and passes the rest on to a Binance deposit address, and Binance can identify the account holder. Other USDT goes to very active services that also receive money from thousands of strangers. Elsewhere, the money keeps splitting: the 25 Tron addresses funded by Rango and Bridgers have already sprayed 40 new addresses.

At 5.30pm, a 2nd statement. The attackers got in through a service provider's platform, which the group does not name, the money left the bank's own account for “other banking players”, then was converted into crypto on specialised platforms. The bank denies any “entry” through Fortuneo, without saying where the transfers came from. Why did the online bank's name come out? Asked again, the various sources get a little tangled, but everything in fact points to a person outside the bank, in charge of Fortuneo among other things, whose access may have been compromised.

The blockchain confirms at least this much: no address in the network looks like the wallet of a bank or a custodian. Finally, the group says its systems enabled it²:

“to identify the suspicious activity very quickly”

At that very moment, according to Zero Bullshit's readings, $15.6M can still be blocked on the blockchain. Gabriel de Brosses, former head of cybersecurity at the La Poste group, the French postal service, speaking to Le Monde³, is harsher:

“The alarms should have gone off.”

The group says part of the funds could be blocked², without saying which. Transfers stopped before conversion would not show on the blockchain, where the only visible freeze at that point is Tether's.

Around 10pm, Tether finally strikes on Tron. An address that has just received $3.06M from the network is frozen with $2.95M of USDT. A 2nd follows within the hour, with $2.25M, then a 3rd before 2.30am, with $2.22M. That one was created overnight from 4 to 5 November, at the end of a chain of more than 60 addresses, each emptied within minutes. $7.4M in total, more than 80 hours after the first withdrawal. Circle has still frozen nothing. According to a judicial source, the Paris prosecutor's office has opened an investigation for organised attack on a computer system, handed to the French anti-cybercrime office.

On Thursday 5 November, between 8.16am and 8.26am, Zero Bullshit sees one of the 3 neighbouring addresses of the preparation, paid before the theft by 3 of the recipient wallets, receive another 141K USDC from the same Kraken exit wallet, in 4 withdrawals, then another 17K at 11.33am and 11.40am, and 8.4K at 2.55pm and 3.05pm. It received 9.4K on 3 November and 34.6K on the 4th. It was already withdrawing comparable amounts in September. Either the account feeding it belongs to a third party unrelated to the theft, or at least one account linked to the recipient wallets is still open at Kraken, which nonetheless says it restricted the accounts involved from 3 November.