On November 2, a single buyer swept 18,800 $ETH in two hours—everyone speculated it was a whale. Today, we have the answer. It wasn’t an institution or a large holder—it was money stolen from a French bank. Crédit Mutuel Arkéa admitted today: it suffered an attack with fraudulent transactions, and some transactions have been suspended. It did not disclose the exact amount stolen, but ZachXBT estimates it exceeded $133 million. I traced back the USDC received by the buyer, 0x9EcA…5547. Of that, 3.0235 million USDC was transferred at 4:14 AM on November 2 from ZachXBT’s disclosed stolen address, 0x90F0…c557, routed through an intermediary address, and arrived intact at 8:22 AM—exactly the same amount. The other three addresses funding this buyer also had direct receipts of USDC from the stolen address. That day, the buyer spent a total of 60.27 million USDC to acquire 26,381 ETH. At the time, everyone assumed it was institutional accumulation. Now it’s clear: this wasn’t accumulation—it was stolen funds fleeing. USDC can be frozen by its issuer; ETH cannot. Those 26,381 ETH have long since been fragmented across a chain of new addresses. One I’m still monitoring currently holds 1,027.9 ETH and was still moving funds out as early as 6 AM today. The bank claims zero customer losses. But on-chain, the movement has never stopped for three days.