Circle Froze $823 Million for Binance. For a French Bank, It Froze Nothing.

At 12:25 UTC on Sunday, November 1, the first withdrawal left an OKX account. Forty-four minutes later, Kraken started paying out too. Over the next 21 hours, $108.8 million in USDC flowed out of accounts at Kraken, Crypto.com and OKX to 15 wallets, according to blockchain data firm Bitquery. One fresh wallet made 43 Kraken withdrawals in 91 minutes, each under $50,000. By Wednesday, on-chain sleuth ZachXBT had named the alleged victim: Crédit Mutuel Arkéa, a French cooperative banking group with more than $235 billion in assets.

Last week this blog argued that during the $6.3 billion Binance hack, the coins with an off switch were the only ones that stopped moving. This week's theft is the other half of that story. Tether and Circle froze roughly $1.57 billion in USDT and $823 million in USDC within hours of the Binance drain. For the French bank, Bitquery found Tether froze 1.14 million USDT and Circle froze none of the USDC still sitting in the thief's wallets.

Eight hundred twenty-three million dollars for an exchange. Zero for a bank.

The off switch on a stablecoin is a phone number, not a feature.

The industry sells freezability as a property of the token. Regulators bought it. The GENIUS Act requires payment stablecoin issuers to keep the technical ability to freeze and burn wallets so they can comply with lawful orders. Banks weighing a move into digital assets hear the same pitch: unlike bitcoin, a dollar token can be stopped.

It can. Someone has to ask, and someone has to say yes. The Arkéa case shows what happens when neither occurs fast enough.

The money was laundered in plain sight while the victim stayed quiet.

ZachXBT first flagged the theft on November 2 as an unnamed "EU entity" that had lost more than $106 million from centralized exchange accounts. He published wallet addresses. He didn't know who the victim was, and nobody came forward. The next day he raised the total to more than $133 million after tracing another $27 million in withdrawals, some of them made after his first disclosure. His working theory, posted to his Telegram channel, was that a large Western European financial institution had been hit and was covering it up. He argued that the lack of prompt disclosure let more than $30 million be laundered that EU law enforcement could have frozen.

The laundering was not subtle. Within about four hours, a fresh wallet sold roughly $63 million of USDC and USDT for 27,553 ETH through UniswapX, Bitquery found. Another branch swapped into DAI, which has no freeze function. Some funds went through Wagyu, a service that TRM tags as a swap-to-Monero route. By Wednesday morning the thief's wallet count had grown from 229 to 392, and about $70.9 million had already exited Ethereum through bridges and exchange deposits.

Every one of those hops was public. Every one happened before anyone with authority asked Circle to act. Bitquery says it doesn't know whether anyone ever did.

Arkéa's statement tells you whose problem the bank thinks this is.

When Arkéa finally spoke, it was to CoinDesk, not to the market. The bank confirmed an attack that "enabled fraudulent transactions," said it was now under control, and said it had suspended some transactions and notified the relevant authorities. It did not confirm the amount, or whether the stolen funds were held in fiat or crypto. Its spokesperson said: "This incident has no financial consequences for [our clients]. Their interests are fully protected."

That is a perfectly normal bank statement. In traditional finance, an incident is handled privately: the fraud team works the problem, regulators get a confidential notice, and customers hear about it if and when they have to. Wire recalls and card chargebacks give banks days to claw money back, so a quiet response costs little.

On a public blockchain, silence is the expensive option. The thief's median wait before moving funds to a fresh wallet was three minutes. A recall window measured in days doesn't help when the window that matters is measured in hours, and the only parties who can still stop the money are an issuer in New York and a handful of exchange compliance desks.

The exchanges, to their credit, moved once the story broke. OKX told CoinDesk it froze an institutional customer account after spotting unusual activity. Crypto.com said it blocked funds linked to the incident. Kraken, which according to Bitquery paid out about 95% of the total across 178 withdrawals, didn't respond to CoinDesk's request for comment.

Concede Circle's point: an issuer shouldn't freeze on a blogger's say-so.

Circle has a defensible answer to all of this, and it has given it before. When ZachXBT accused the company in April of failing to freeze USDC tied to 15 cases worth more than $420 million, including the Drift exploit, a spokesperson said Circle freezes assets "when legally required, consistent with the rule of law," meaning sanctions, law enforcement orders and court mandates.

That's not a dodge. A stablecoin issuer that freezes wallets because an anonymous investigator posted addresses on Telegram is an issuer that can be weaponized by anyone with a plausible thread. USDC's value to honest holders depends partly on Circle not acting as a vigilante. The GENIUS Act's language is built around lawful orders for the same reason.

So why did the Binance hack get $823 million in freezes within hours? Because Binance did what Arkéa didn't. It disclosed immediately, loudly, and with its co-founder publicly thanking the issuers by name. An exchange that size has standing relationships with Circle and Tether, a security team that speaks their language, and every incentive to make noise. A bank that apparently hoped to handle it quietly gave the issuers nothing to act on.

The thesis holds. The freeze is real, but it is a relationship, not a property of the token. It works for victims who know whom to call and are willing to call fast. It does very little for victims who treat a crypto theft the way they'd treat a wire fraud.

Banks are about to bring that habit into crypto at scale.

This matters beyond one French bank. Arkéa applied in May for a MiCA license to offer crypto services to retail customers and other financial institutions, according to L'Agefi. It is one of many traditional lenders lining up to hold digital assets for clients. The pitch to their boards includes the idea that dollar stablecoins are safer because they can be frozen.

Meanwhile, on the same Wednesday that Arkéa confirmed the attack, Circle reported $865 million in third-quarter revenue and reserve income and $13.9 trillion in on-chain USDC transaction volume, up 49% from a year earlier. It also disclosed a 5% workforce cut. The rails are getting busier, faster and cheaper to run. The process for stopping stolen money on them still runs on someone noticing, someone disclosing, and someone with a badge sending a letter.

None of that is written into the token contract. It lives in incident-response playbooks, and most bank playbooks were written for a world where the money stays inside the system long enough to recall. A bank that holds USDC needs a plan that starts with calling the issuer and law enforcement in the first hour, and that accepts the reputational cost of going public, because the public already has the wallet addresses.

The next institution to get drained will face the same choice Arkéa faced on November 1: stay quiet and protect the brand, or speak up and maybe protect the money. On-chain, you rarely get both.